use hmac_sha256 when assembling csrf token master
authorOguz Bektas <o.bektas@proxmox.com>
Wed, 19 Jun 2019 07:39:32 +0000 (09:39 +0200)
committerThomas Lamprecht <t.lamprecht@proxmox.com>
Wed, 19 Jun 2019 10:29:35 +0000 (12:29 +0200)
Signed-off-by: Oguz Bektas <o.bektas@proxmox.com>
src/PVE/Ticket.pm

index 8521229..d522401 100644 (file)
@@ -20,7 +20,7 @@ sub assemble_csrf_prevention_token {
 
     my $timestamp = sprintf("%08X", time());
 
-    my $digest = Digest::SHA::sha1_base64("$timestamp:$username", $secret);
+    my $digest = Digest::SHA::hmac_sha256_base64("$timestamp:$username", $secret);
 
     return "$timestamp:$digest";
 }