flashii/misuzu
flashii/misuzu
3
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Use Index for CSRF protection tokens.

Browse source
This commit is contained in:
flash 2023-07-11 22:13:56 +00:00
parent 5d62e6e741
commit 163ff95cdf
2 changed files with 13 additions and 91 deletions

8
misuzu.php
View file

@ -214,11 +214,9 @@ if($authToken->isValid()) {
AuthToken::nukeCookie();
}
CSRF::setGlobalSecretKey($cfg->getValue('csrf.secret', IConfig::T_STR, 'soup'));
CSRF::setGlobalIdentity(
UserSession::hasCurrent()
? UserSession::getCurrent()->getToken()
: ($_SERVER['REMOTE_ADDR'] ?? '::1')
CSRF::init(
$cfg->getValue('csrf.secret', IConfig::T_STR, 'soup'),
(UserSession::hasCurrent() ? UserSession::getCurrent()->getToken() : ($_SERVER['REMOTE_ADDR'] ?? '::1'))
);
function mszLockdown(): void {