New login flow creates two app tokens

[Bubu]

Actual behaviour

• Install app (current master dd65fb9), test built for fdroid
• Login via webview
• Go to Settings - Personal - Security
• See that there are 2 new devices, named identically, created at the same second

Expected behaviour

• Only one new device is added

Environment data

Android version:

• LineageOS 14.1 (is Android 7.1.2)
• also reproduced on sdk 25 emulator

Device model: Emulator, moto e surnia

Stock or customized system:

Nextcloud app version: dd65fb9

Nextcloud server version: 12.0.2

Logs

Web server error log

Tell me if you need this.

Nextcloud log (data/nextcloud.log)

Maybe some of this is relevant?

{"reqId":"GEsxeEE24wGGhynZdKL8","level":3,"time":"2017-08-26T15:12:08+00:00","remoteAddr":"::1","user":"--","app":"PHP","method":"GET","url":"\/index.php\/login\/flow","message":"Undefined index: oauthState at \/usr\/share\/webapps\/nextcloud\/core\/templates\/loginflow\/authpicker.php#38","userAgent":"Unknown Android SDK built for x86","version":"12.0.2.0"}
{"reqId":"ELdwakFte07HdAvnNLnz","level":3,"time":"2017-08-26T15:16:34+00:00","remoteAddr":"::1","user":"--","app":"PHP","method":"GET","url":"\/index.php\/login\/flow","message":"Undefined index: oauthState at \/usr\/share\/webapps\/nextcloud\/core\/templates\/loginflow\/authpicker.php#38","userAgent":"Motorola XT1524","version":"12.0.2.0"}
{"reqId":"2yeFH43oUZediH8PjuAF","level":2,"time":"2017-08-26T15:19:22+00:00","remoteAddr":"::1","user":"--","app":"core","method":"HEAD","url":"\/remote.php\/webdav\/","message":"Login failed: '<username>' (Remote IP: '::1')","userAgent":"Mozilla\/5.0 (Android) ownCloud-android\/2.0.0RC5","version":"12.0.2.0"}
{"reqId":"2yeFH43oUZediH8PjuAF","level":1,"time":"2017-08-26T15:19:22+00:00","remoteAddr":"::1","user":"--","app":"core","method":"HEAD","url":"\/remote.php\/webdav\/","message":"Bruteforce attempt from \"::1\" detected for action \"login\".","userAgent":"Mozilla\/5.0 (Android) ownCloud-android\/2.0.0RC5","version":"12.0.2.0"}
{"reqId":"kYb2bw6k9W5cKJcp0tfH","level":2,"time":"2017-08-26T15:19:33+00:00","remoteAddr":"::1","user":"--","app":"core","method":"HEAD","url":"\/remote.php\/webdav\/","message":"Login failed: '<username>' (Remote IP: '::1')","userAgent":"Mozilla\/5.0 (Android) ownCloud-android\/2.0.0RC5","version":"12.0.2.0"}
{"reqId":"kYb2bw6k9W5cKJcp0tfH","level":1,"time":"2017-08-26T15:19:33+00:00","remoteAddr":"::1","user":"--","app":"core","method":"HEAD","url":"\/remote.php\/webdav\/","message":"Bruteforce attempt from \"::1\" detected for action \"login\".","userAgent":"Mozilla\/5.0 (Android) ownCloud-android\/2.0.0RC5","version":"12.0.2.0"}
{"reqId":"1SkRy84O3ErLXcESfglp","level":2,"time":"2017-08-26T15:20:07+00:00","remoteAddr":"::1","user":"--","app":"core","method":"HEAD","url":"\/remote.php\/webdav\/","message":"Login failed: '<username>' (Remote IP: '::1')","userAgent":"Mozilla\/5.0 (Android) ownCloud-android\/2.0.0RC5","version":"12.0.2.0"}
{"reqId":"1SkRy84O3ErLXcESfglp","level":1,"time":"2017-08-26T15:20:07+00:00","remoteAddr":"::1","user":"--","app":"core","method":"HEAD","url":"\/remote.php\/webdav\/","message":"Bruteforce attempt from \"::1\" detected for action \"login\".","userAgent":"Mozilla\/5.0 (Android) ownCloud-android\/2.0.0RC5","version":"12.0.2.0"}
{"reqId":"79igdpuyAu0VeNJJ9VrA","level":3,"time":"2017-08-26T15:20:21+00:00","remoteAddr":"::1","user":"--","app":"PHP","method":"GET","url":"\/index.php\/login\/flow","message":"Undefined index: oauthState at \/usr\/share\/webapps\/nextcloud\/core\/templates\/loginflow\/authpicker.php#38","userAgent":"Unknown Android SDK built for x86","version":"12.0.2.0"}
{"reqId":"L5uOZ5qXkYB6abGKDU1F","level":3,"time":"2017-08-26T15:22:35+00:00","remoteAddr":"::1","user":"<username>","app":"no app in context","method":"PROPFIND","url":"\/remote.php\/webdav\/","message":"Exception: {\"Exception\":\"Sabre\\\\HTTP\\\\ClientHttpException\",\"Message\":\"Method Not Allowed\",\"Code\":405,\"Trace\":\"#0 \\\/usr\\\/share\\\/webapps\\\/nextcloud\\\/3rdparty\\\/sabre\\\/dav\\\/lib\\\/DAV\\\/Client.php(231): Sabre\\\\HTTP\\\\Client->send(Object(Sabre\\\\HTTP\\\\Request))\\n#1 \\\/usr\\\/share\\\/webapps\\\/nextcloud\\\/lib\\\/private\\\/Files\\\/Storage\\\/DAV.php(263): Sabre\\\\DAV\\\\Client->propFind('http:\\\/\\\/176.9.14...', Array)\\n#2 \\\/usr\\\/share\\\/webapps\\\/nextcloud\\\/lib\\\/private\\\/Files\\\/Storage\\\/DAV.php(577): OC\\\\Files\\\\Storage\\\\DAV->propfind('')\\n#3 \\\/usr\\\/share\\\/webapps\\\/nextcloud\\\/lib\\\/private\\\/Files\\\/Storage\\\/Common.php(444): OC\\\\Files\\\\Storage\\\\DAV->stat('')\\n#4 \\\/usr\\\/share\\\/webapps\\\/nextcloud\\\/apps\\\/files_sharing\\\/lib\\\/External\\\/Storage.php(184): OC\\\\Files\\\\Storage\\\\Common->test()\\n#5 \\\/usr\\\/share\\\/webapps\\\/nextcloud\\\/lib\\\/private\\\/Files\\\/Storage\\\/Wrapper\\\/Wrapper.php(467): OCA\\\\Files_Sharing\\\\External\\\\Storage->test()\\n#6 \\\/usr\\\/share\\\/webapps\\\/nextcloud\\\/lib\\\/private\\\/Files\\\/Storage\\\/Wrapper\\\/Availability.php(52): OC\\\\Files\\\\Storage\\\\Wrapper\\\\Wrapper->test()\\n#7 \\\/usr\\\/share\\\/webapps\\\/nextcloud\\\/lib\\\/private\\\/Files\\\/Storage\\\/Wrapper\\\/Availability.php(66): OC\\\\Files\\\\Storage\\\\Wrapper\\\\Availability->updateAvailability()\\n#8 \\\/usr\\\/share\\\/webapps\\\/nextcloud\\\/lib\\\/private\\\/Files\\\/Storage\\\/Wrapper\\\/Availability.php(75): OC\\\\Files\\\\Storage\\\\Wrapper\\\\Availability->isAvailable()\\n#9 \\\/usr\\\/share\\\/webapps\\\/nextcloud\\\/lib\\\/private\\\/Files\\\/Storage\\\/Wrapper\\\/Availability.php(349): OC\\\\Files\\\\Storage\\\\Wrapper\\\\Availability->checkAvailability()\\n#10 \\\/usr\\\/share\\\/webapps\\\/nextcloud\\\/lib\\\/private\\\/Files\\\/Storage\\\/Wrapper\\\/Wrapper.php(327): OC\\\\Files\\\\Storage\\\\Wrapper\\\\Availability->free_space('')\\n#11 \\\/usr\\\/share\\\/webapps\\\/nextcloud\\\/lib\\\/private\\\/legacy\\\/helper.php(581): OC\\\\Files\\\\Storage\\\\Wrapper\\\\Wrapper->free_space('')\\n#12 \\\/usr\\\/share\\\/webapps\\\/nextcloud\\\/apps\\\/dav\\\/lib\\\/Connector\\\/Sabre\\\/Directory.php(324): OC_Helper::getStorageInfo('\\\/<username>\\\/files\\\/Bub...', Object(OC\\\\Files\\\\FileInfo))\\n#13 \\\/usr\\\/share\\\/webapps\\\/nextcloud\\\/3rdparty\\\/sabre\\\/dav\\\/lib\\\/DAV\\\/CorePlugin.php(805): OCA\\\\DAV\\\\Connector\\\\Sabre\\\\Directory->getQuotaInfo()\\n#14 \\\/usr\\\/share\\\/webapps\\\/nextcloud\\\/3rdparty\\\/sabre\\\/dav\\\/lib\\\/DAV\\\/PropFind.php(98): Sabre\\\\DAV\\\\CorePlugin->Sabre\\\\DAV\\\\{closure}()\\n#15 \\\/usr\\\/share\\\/webapps\\\/nextcloud\\\/3rdparty\\\/sabre\\\/dav\\\/lib\\\/DAV\\\/CorePlugin.php(807): Sabre\\\\DAV\\\\PropFind->handle('{DAV:}quota-use...', Object(Closure))\\n#16 [internal function]: Sabre\\\\DAV\\\\CorePlugin->propFind(Object(Sabre\\\\DAV\\\\PropFind), Object(OCA\\\\DAV\\\\Connector\\\\Sabre\\\\Directory))\\n#17 \\\/usr\\\/share\\\/webapps\\\/nextcloud\\\/3rdparty\\\/sabre\\\/event\\\/lib\\\/EventEmitterTrait.php(105): call_user_func_array(Array, Array)\\n#18 \\\/usr\\\/share\\\/webapps\\\/nextcloud\\\/3rdparty\\\/sabre\\\/dav\\\/lib\\\/DAV\\\/Server.php(1059): Sabre\\\\Event\\\\EventEmitter->emit('propFind', Array)\\n#19 \\\/usr\\\/share\\\/webapps\\\/nextcloud\\\/3rdparty\\\/sabre\\\/dav\\\/lib\\\/DAV\\\/Server.php(981): Sabre\\\\DAV\\\\Server->getPropertiesByNode(Object(Sabre\\\\DAV\\\\PropFind), Object(OCA\\\\DAV\\\\Connector\\\\Sabre\\\\Directory))\\n#20 \\\/usr\\\/share\\\/webapps\\\/nextcloud\\\/3rdparty\\\/sabre\\\/dav\\\/lib\\\/DAV\\\/Server.php(1666): Sabre\\\\DAV\\\\Server->getPropertiesIteratorForPath('', Array, 1)\\n#21 \\\/usr\\\/share\\\/webapps\\\/nextcloud\\\/3rdparty\\\/sabre\\\/dav\\\/lib\\\/DAV\\\/CorePlugin.php(355): Sabre\\\\DAV\\\\Server->generateMultiStatus(Object(Generator), false)\\n#22 [internal function]: Sabre\\\\DAV\\\\CorePlugin->httpPropFind(Object(Sabre\\\\HTTP\\\\Request), Object(Sabre\\\\HTTP\\\\Response))\\n#23 \\\/usr\\\/share\\\/webapps\\\/nextcloud\\\/3rdparty\\\/sabre\\\/event\\\/lib\\\/EventEmitterTrait.php(105): call_user_func_array(Array, Array)\\n#24 \\\/usr\\\/share\\\/webapps\\\/nextcloud\\\/3rdparty\\\/sabre\\\/dav\\\/lib\\\/DAV\\\/Server.php(479): Sabre\\\\Event\\\\EventEmitter->emit('method:PROPFIND', Array)\\n#25 \\\/usr\\\/share\\\/webapps\\\/nextcloud\\\/3rdparty\\\/sabre\\\/dav\\\/lib\\\/DAV\\\/Server.php(254): Sabre\\\\DAV\\\\Server->invokeMethod(Object(Sabre\\\\HTTP\\\\Request), Object(Sabre\\\\HTTP\\\\Response))\\n#26 \\\/usr\\\/share\\\/webapps\\\/nextcloud\\\/apps\\\/dav\\\/appinfo\\\/v1\\\/webdav.php(71): Sabre\\\\DAV\\\\Server->exec()\\n#27 \\\/usr\\\/share\\\/webapps\\\/nextcloud\\\/remote.php(162): require_once('\\\/usr\\\/share\\\/weba...')\\n#28 {main}\",\"File\":\"\\\/usr\\\/share\\\/webapps\\\/nextcloud\\\/3rdparty\\\/sabre\\\/http\\\/lib\\\/Client.php\",\"Line\":160}","userAgent":"Mozilla\/5.0 (Android) ownCloud-android\/2.0.0RC5","version":"12.0.2.0"}
{"reqId":"L5uOZ5qXkYB6abGKDU1F","level":3,"time":"2017-08-26T15:22:35+00:00","remoteAddr":"::1","user":"<username>","app":"files_external","method":"PROPFIND","url":"\/remote.php\/webdav\/","message":"Method Not Allowed","userAgent":"Mozilla\/5.0 (Android) ownCloud-android\/2.0.0RC5","version":"12.0.2.0"}
{"reqId":"L5uOZ5qXkYB6abGKDU1F","level":3,"time":"2017-08-26T15:22:35+00:00","remoteAddr":"::1","user":"<username>","app":"PHP","method":"PROPFIND","url":"\/remote.php\/webdav\/","message":"Undefined variable: response at \/usr\/share\/webapps\/nextcloud\/lib\/private\/Files\/Storage\/DAV.php#286","userAgent":"Mozilla\/5.0 (Android) ownCloud-android\/2.0.0RC5","version":"12.0.2.0"}
{"reqId":"s28OJbmJNQ161s3LoRjL","level":3,"time":"2017-08-26T15:23:39+00:00","remoteAddr":"::1","user":"--","app":"PHP","method":"GET","url":"\/index.php\/login\/flow","message":"Undefined index: oauthState at \/usr\/share\/webapps\/nextcloud\/core\/templates\/loginflow\/authpicker.php#38","userAgent":"Motorola XT1524","version":"12.0.2.0"}
{"reqId":"B1QtDRUu9hwSa2MqW554","level":2,"time":"2017-08-26T15:25:56+00:00","remoteAddr":"::1","user":"--","app":"core","method":"PROPFIND","url":"\/remote.php\/webdav\/<username>\/","message":"Login failed: '<username>' (Remote IP: '::1')","userAgent":"Mozilla\/5.0 (Android) ownCloud-android\/2.0.0RC5","version":"12.0.2.0"}
{"reqId":"B1QtDRUu9hwSa2MqW554","level":1,"time":"2017-08-26T15:25:56+00:00","remoteAddr":"::1","user":"--","app":"core","method":"PROPFIND","url":"\/remote.php\/webdav\/<username>\/","message":"Bruteforce attempt from \"::1\" detected for action \"login\".","userAgent":"Mozilla\/5.0 (Android) ownCloud-android\/2.0.0RC5","version":"12.0.2.0"}
{"reqId":"PpRwp33vjpAeuio7RR32","level":3,"time":"2017-08-26T15:25:57+00:00","remoteAddr":"::1","user":"--","app":"PHP","method":"GET","url":"\/index.php\/login\/flow","message":"Undefined index: oauthState at \/usr\/share\/webapps\/nextcloud\/core\/templates\/loginflow\/authpicker.php#38","userAgent":"Unknown Android SDK built for x86","version":"12.0.2.0"}
{"reqId":"c1sWr0pOVo86WCRYs7oo","level":4,"time":"2017-08-26T15:26:51+00:00","remoteAddr":"::1","user":"<username>","app":"webdav","method":"PROPFIND","url":"\/remote.php\/webdav\/<username>\/","message":"Exception: {\"Exception\":\"Sabre\\\\DAV\\\\Exception\\\\ServiceUnavailable\",\"Message\":\"Storage is temporarily not available\",\"Code\":0,\"Trace\":\"#0 \\\/usr\\\/share\\\/webapps\\\/nextcloud\\\/3rdparty\\\/sabre\\\/dav\\\/lib\\\/DAV\\\/Server.php(967): OCA\\\\DAV\\\\Connector\\\\Sabre\\\\ObjectTree->getNodeForPath('<username>')\\n#1 \\\/usr\\\/share\\\/webapps\\\/nextcloud\\\/3rdparty\\\/sabre\\\/dav\\\/lib\\\/DAV\\\/Server.php(1666): Sabre\\\\DAV\\\\Server->getPropertiesIteratorForPath('<username>', Array, 0)\\n#2 \\\/usr\\\/share\\\/webapps\\\/nextcloud\\\/3rdparty\\\/sabre\\\/dav\\\/lib\\\/DAV\\\/CorePlugin.php(355): Sabre\\\\DAV\\\\Server->generateMultiStatus(Object(Generator), false)\\n#3 [internal function]: Sabre\\\\DAV\\\\CorePlugin->httpPropFind(Object(Sabre\\\\HTTP\\\\Request), Object(Sabre\\\\HTTP\\\\Response))\\n#4 \\\/usr\\\/share\\\/webapps\\\/nextcloud\\\/3rdparty\\\/sabre\\\/event\\\/lib\\\/EventEmitterTrait.php(105): call_user_func_array(Array, Array)\\n#5 \\\/usr\\\/share\\\/webapps\\\/nextcloud\\\/3rdparty\\\/sabre\\\/dav\\\/lib\\\/DAV\\\/Server.php(479): Sabre\\\\Event\\\\EventEmitter->emit('method:PROPFIND', Array)\\n#6 \\\/usr\\\/share\\\/webapps\\\/nextcloud\\\/3rdparty\\\/sabre\\\/dav\\\/lib\\\/DAV\\\/Server.php(254): Sabre\\\\DAV\\\\Server->invokeMethod(Object(Sabre\\\\HTTP\\\\Request), Object(Sabre\\\\HTTP\\\\Response))\\n#7 \\\/usr\\\/share\\\/webapps\\\/nextcloud\\\/apps\\\/dav\\\/appinfo\\\/v1\\\/webdav.php(71): Sabre\\\\DAV\\\\Server->exec()\\n#8 \\\/usr\\\/share\\\/webapps\\\/nextcloud\\\/remote.php(162): require_once('\\\/usr\\\/share\\\/weba...')\\n#9 {main}\",\"File\":\"\\\/usr\\\/share\\\/webapps\\\/nextcloud\\\/apps\\\/dav\\\/lib\\\/Connector\\\/Sabre\\\/ObjectTree.php\",\"Line\":162}","userAgent":"Mozilla\/5.0 (Android) ownCloud-android\/2.0.0RC5","version":"12.0.2.0"}

[TFLye]

what

[rullzer]

This is not a bug in the android client. It is a bug server side... one is the actual new token. The other is the session created when logging in I bet.

[rullzer]

Moved to nextcloud/server#7697