From 868ecbea55c44dd44b970543dea5f4b1dc8c5a5c Mon Sep 17 00:00:00 2001
From: Hivert Quentin <quentin.hivert.fr@gmail.com>
Date: Wed, 14 Oct 2026 10:46:50 +0200
Subject: [PATCH] fix(user): check session key value before using it

---
 SOPE/GDLContentStore/GCSSessionsFolder.m | 3 ++-
 SoObjects/SOGo/SOGoSession.m             | 5 +++++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/SOPE/GDLContentStore/GCSSessionsFolder.m b/SOPE/GDLContentStore/GCSSessionsFolder.m
index b550ec974..4dc08960c 100644
--- a/SOPE/GDLContentStore/GCSSessionsFolder.m
+++ b/SOPE/GDLContentStore/GCSSessionsFolder.m
@@ -204,7 +204,7 @@ static NSString *sessionsFolderURLString = nil;
   NSArray *attrs;
   NSDictionary *record;
   EOEntity *entity;
-  EOSQLQualifier *qualifier;
+  EOQualifier *qualifier;
 
   record = nil;
 
@@ -217,6 +217,7 @@ static NSString *sessionsFolderURLString = nil;
                                          qualifierFormat:
                                             @"c_id='%@'",
                                           theID];
+
       [qualifier autorelease];
 
       [context beginTransaction];
diff --git a/SoObjects/SOGo/SOGoSession.m b/SoObjects/SOGo/SOGoSession.m
index 8f07b4910..be003acc2 100644
--- a/SoObjects/SOGo/SOGoSession.m
+++ b/SoObjects/SOGo/SOGoSession.m
@@ -45,6 +45,11 @@
 
   cache = [SOGoCache sharedCache];
 
+  //We check that the session is base64
+  NSData *decodedData = [[NSData alloc] initWithBase64EncodedString:theSessionKey options:0];
+  if(!decodedData)
+    return value;
+
   key = [NSString stringWithFormat: @"session:%@", theSessionKey];
   value = [cache valueForKey: key];