diff options
| author | Morris Jobke <hey@morrisjobke.de> | 2015-08-24 09:14:27 +0200 |
|---|---|---|
| committer | Morris Jobke <hey@morrisjobke.de> | 2015-08-24 09:14:27 +0200 |
| commit | 40b1054530229139a5cacf28ed4b883d52835ad6 (patch) | |
| tree | ae6693babddc83bf4c77ef7890726a6b517ed392 /lib/private/util.php | |
| parent | 510010e774c4019b7fc616c90085649abb7afac3 (diff) | |
| parent | df2ce8a075d70a2180f2b1c7685b19db6d3ce91b (diff) | |
| download | nextcloud-server-40b1054530229139a5cacf28ed4b883d52835ad6.tar.gz nextcloud-server-40b1054530229139a5cacf28ed4b883d52835ad6.zip | |
Merge pull request #18254 from owncloud/mitigate-breach
Add mitigation against BREACH
Diffstat (limited to 'lib/private/util.php')
| -rw-r--r-- | lib/private/util.php | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/lib/private/util.php b/lib/private/util.php index 501dbf5c4c5..edd375b5c36 100644 --- a/lib/private/util.php +++ b/lib/private/util.php @@ -1057,7 +1057,8 @@ class OC_Util { /** * Register an get/post call. Important to prevent CSRF attacks. * - * @return string Generated token. + * @return string The encrypted CSRF token, the shared secret is appended after the `:`. + * * @description * Creates a 'request token' (random) and stores it inside the session. * Ever subsequent (ajax) request must use such a valid token to succeed, @@ -1074,7 +1075,10 @@ class OC_Util { // Valid token already exists, send it $requestToken = \OC::$server->getSession()->get('requesttoken'); } - return ($requestToken); + + // Encrypt the token to mitigate breach-like attacks + $sharedSecret = \OC::$server->getSecureRandom()->getMediumStrengthGenerator()->generate(10); + return \OC::$server->getCrypto()->encrypt($requestToken, $sharedSecret) . ':' . $sharedSecret; } /** |