use hmac_sha256 instead of sha1 for csrf token

Signed-off-by: Oguz Bektas <o.bektas@proxmox.com>

diff --git a/PVE/AccessControl.pm b/PVE/AccessControl.pm
index 6ac99ac28d716d321d2778bfd4e80f441701044d..e3f90eefbf6256ec3f37f033d30af31f848a245b 100644 (file)
--- a/PVE/AccessControl.pm
+++ b/PVE/AccessControl.pm
@@ -215,7 +215,7 @@ my $csrf_prevention_secret;
 my $get_csrfr_secret = sub {
     if (!$csrf_prevention_secret) {
        my $input = PVE::Tools::file_get_contents($pve_www_key_fn);
-       $csrf_prevention_secret = Digest::SHA::sha1_base64($input);
+       $csrf_prevention_secret = Digest::SHA::hmac_sha256_base64($input);
     }
     return $csrf_prevention_secret;
 };