Congegni/sintonia
7
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Use more secure random number generation for CSRF auth tokens

Browse source 
* Also cleaned up pull request
This commit is contained in:
Albert Santoni 2015-02-24 11:13:39 -05:00
parent be7cae4408
commit 73e5fb938f
2 changed files with 4 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

2
airtime_mvc/application/controllers/plugins/Acl_plugin.php
View file

@ -156,7 +156,7 @@ class Zend_Controller_Plugin_Acl extends Zend_Controller_Plugin_Abstract
if (!$tokenValid) {
$csrf_namespace = new Zend_Session_Namespace('csrf_namespace');
$csrf_namespace->authtoken = sha1(uniqid(rand(),1));
$csrf_namespace->authtoken = sha1(openssl_random_pseudo_bytes(128));
Logging::warn("Invalid CSRF token: $token");
$this->getResponse()