badmanners/shimmie2
badmanners/shimmie2
Archived
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[core] have a system level SECRET variable, to be used as a salt separate from DATABASE_DSN

Browse source
This commit is contained in:
Shish 2024-06-20 01:13:25 +01:00 committed by Shish
parent 8cb87b2469
commit be842308d9
4 changed files with 5 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
core/install.php
View file

@ -314,7 +314,8 @@ function create_tables(Database $db): void
function write_config(string $dsn): void
{
$file_content = "<" . "?php\ndefine('DATABASE_DSN', '$dsn');\n";
$secret = bin2hex(random_bytes(16));
$file_content = "<" . "?php\ndefine('DATABASE_DSN', '$dsn');\ndefine('SECRET', '$secret');\n";
if (!file_exists("data/config")) {
mkdir("data/config", 0755, true);

1
core/sys_config.php
View file

@ -38,3 +38,4 @@ _d("BASE_HREF", null); // string force a specific base URL (default i
_d("TRACE_FILE", null); // string file to log performance data into
_d("TRACE_THRESHOLD", 0.0); // float log pages which take more time than this many seconds
_d("TRUSTED_PROXIES", []); // array trust "X-Real-IP" / "X-Forwarded-For" / "X-Forwarded-Proto" headers from these IP ranges
_d("SECRET", DATABASE_DSN); // string A secret bit of data used to salt some hashes

2
core/user.php
View file

@ -249,7 +249,7 @@ class User
public function get_auth_token(): string
{
global $config;
$salt = DATABASE_DSN;
$salt = SECRET;
$addr = get_session_ip($config);
return md5(md5($this->passhash . $addr) . "salty-csrf-" . $salt);
}

1
tests/defines.php
View file

@ -23,3 +23,4 @@ define("TIMEZONE", 'UTC');
define("CLI_LOG_LEVEL", 50);
define("STATSD_HOST", null);
define("TRUSTED_PROXIES", []);
define("SECRET", "asdfghjkl");