Friendica/friendica-github
1
0
Fork 0
mirror of https://github.com/friendica/friendica synced 2025-05-03 03:04:23 +02:00
Code Issues Projects Releases Packages Wiki Activity

Fix security vulnerbilities.

Browse source 
Fix possible length extension attack, predicable generators, timing attacks on hash comparision and improved formatting.
This commit is contained in:
dew-git 2019-10-10 15:21:41 -08:00
parent 50fa119f79
commit 811cdcdfcb
8 changed files with 455 additions and 332 deletions
Download patch file Download diff file Expand all files Collapse all files

8
src/Network/FKOAuthDataStore.php
View file

@ -29,7 +29,7 @@ class FKOAuthDataStore extends OAuthDataStore
*/
private static function genToken()
{
return md5(base64_encode(pack('N6', mt_rand(), mt_rand(), mt_rand(), mt_rand(), mt_rand(), uniqid())));
return bin2hex(random_bytes(16));
}
/**
@ -119,7 +119,8 @@ class FKOAuthDataStore extends OAuthDataStore
'secret' => $sec,
'client_id' => $k,
'scope' => 'request',
'expires' => time() + REQUEST_TOKEN_DURATION]
'expires' => time() + REQUEST_TOKEN_DURATION
]
);
if (!$r) {
@ -162,7 +163,8 @@ class FKOAuthDataStore extends OAuthDataStore
'client_id' => $consumer->key,
'scope' => 'access',
'expires' => time() + ACCESS_TOKEN_DURATION,
'uid' => $uverifier]
'uid' => $uverifier
]
);
if ($r) {