improve CSRF compat with newer PVE

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>

diff --git a/PVE/AccessControl.pm b/PVE/AccessControl.pm
index 512fcd2dddcd8844a5edf18cedb5d56411512739..fc519f1d63c5ba9d5c5a7fe121d23a39f9fb5cc7 100644 (file)
--- a/PVE/AccessControl.pm
+++ b/PVE/AccessControl.pm
@@ -210,10 +210,12 @@ sub rotate_authkey {
 }
 
 my $csrf_prevention_secret;
+my $csrf_prevention_secret_pve6; # for future compat during upgrades
 my $get_csrfr_secret = sub {
     if (!$csrf_prevention_secret) {
        my $input = PVE::Tools::file_get_contents($pve_www_key_fn);
        $csrf_prevention_secret = Digest::SHA::sha1_base64($input);
+       $csrf_prevention_secret_pve6 = Digest::SHA::hmac_sha256_base64($input);
     }
     return $csrf_prevention_secret;
 };
@@ -229,7 +231,15 @@ sub assemble_csrf_prevention_token {
 sub verify_csrf_prevention_token {
     my ($username, $token, $noerr) = @_;
 
-    my $secret =  &$get_csrfr_secret();
+    my $secret = $get_csrfr_secret->();
+
+    if ($token =~ m/^([A-Z0-9]{8}):(\S+)$/) {
+       my $sig = $2;
+       if (length($sig) > 27) {
+           # the future pve 6 secret got populated by above get_csrfr_secret call
+           $secret = $csrf_prevention_secret_pve6;
+       }
+    }
 
     return PVE::Ticket::verify_csrf_prevention_token(
        $secret, $username, $token, -300, $ticket_lifetime, $noerr);