use hmac_sha256 when assembling csrf token

[pve-common.git] / src / PVE / Ticket.pm

diff --git a/src/PVE/Ticket.pm b/src/PVE/Ticket.pm
index 8521229d868cfe4a1dc63d8ec1f588a15d950cd0..d522401436f9873f7cc07d07b86ce1d09adc0ffc 100644 (file)
--- a/src/PVE/Ticket.pm
+++ b/src/PVE/Ticket.pm
@@ -20,7 +20,7 @@ sub assemble_csrf_prevention_token {
 
     my $timestamp = sprintf("%08X", time());
 
 
     my $timestamp = sprintf("%08X", time());
 

-    my $digest = Digest::SHA::sha1_base64("$timestamp:$username", $secret);
+    my $digest = Digest::SHA::hmac_sha256_base64("$timestamp:$username", $secret);

 
     return "$timestamp:$digest";
 }
 
     return "$timestamp:$digest";
 }