proxmox-mirrors/pve-common
1
0
Fork 0
mirror of https://git.proxmox.com/git/pve-common synced 2025-04-29 16:08:48 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

ticket: remove fallback for SHA1-base64 CSRF prevention tokens

Browse Source 
Signed-off-by: Max Carrara <m.carrara@proxmox.com>
This commit is contained in:
Max Carrara 2024-02-20 16:08:36 +01:00 committed by Wolfgang Bumiller
parent 68b234f35e
commit ff39327769
1 changed files with 1 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/PVE/Ticket.pm
View File

@ -34,13 +34,7 @@ sub verify_csrf_prevention_token {
my $timestamp = $1; my $timestamp = $1;
my $ttime = hex($timestamp); my $ttime = hex($timestamp);
my $digest; my $digest = Digest::SHA::hmac_sha256_base64("$timestamp:$username", $secret);
if (length($sig) == 27) {
# detected sha1 csrf token from older proxy, fallback. FIXME: remove with 7.0
$digest = Digest::SHA::sha1_base64("$timestamp:$username", $secret);
} else {
$digest = Digest::SHA::hmac_sha256_base64("$timestamp:$username", $secret);
}
my $age = time() - $ttime; my $age = time() - $ttime;
return 1 if ($digest eq $sig) && ($age > $min_age) && return 1 if ($digest eq $sig) && ($age > $min_age) &&