Differential D25031 Diff 83 src/applications/auth/engine/PhabricatorAuthCSRFEngine.php

Changeset View

Standalone View

Context not available.

	// We expect a BREACH-mitigating token. See T3684.	// We expect a BREACH-mitigating token. See T3684.
	$breach_prefix = $this->getBREACHPrefix();	$breach_prefix = $this->getBREACHPrefix();
	$breach_prelen = strlen($breach_prefix);	$breach_prelen = @strlen($breach_prefix);
	if (strncmp($token, $breach_prefix, $breach_prelen) !== 0) {	if (strncmp($token, $breach_prefix, $breach_prelen) !== 0) {
	return false;	return false;
	}	}

	$salt = substr($token, $breach_prelen, $salt_length);	$salt = @substr($token, $breach_prelen, $salt_length);
	$token = substr($token, $breach_prelen + $salt_length);	$token = @substr($token, $breach_prelen + $salt_length);

	foreach ($this->getWindowOffsets() as $offset) {	foreach ($this->getWindowOffsets() as $offset) {
	$expect_token = $this->newRawToken($salt, $offset);	$expect_token = $this->newRawToken($salt, $offset);
Context not available.
	$secret.$time_block.$salt,	$secret.$time_block.$salt,
	'csrf');	'csrf');

	return substr($hash, 0, $this->getTokenLength());	return @substr($hash, 0, $this->getTokenLength());
	}	}

	private function getBREACHPrefix() {	private function getBREACHPrefix() {
Context not available.