[#8714] - Harden CSRF token generation (Fix #8710)
- Closed
- 8 Jan 2016
- Medium
- Build: staging
- # 8714
- Diff
- mbabker:CSRF-hardening
- Success Human Test Results: 2 Successful 0 Failed. Details
User tests: Successful: Unsuccessful:
Unless there's a reason CSRF tokens cannot contain [A-Z][a-z][0-9] then proxying to JUserHelper::genRandomPassword() (which is using random_bytes() in its generation of random strings) is good enough here.
Testing instructions
CSRF validation should still pass on forms
| Status | New | ⇒ | Pending |
joomla-cms-bot
- | Labels |
Added:
?
|
||
This uses the backported version we have in https://github.com/joomla/joomla-cms/tree/staging/libraries/vendor/paragonie/random_compat/lib
ah I see that now - was waiting for PHPStorm to index the whole project....sloooooowly
| Milestone |
Added: |
||
I have tested this item 
successfully on 6fc1875
Thank you @mbabker!
This comment was created with the J!Tracker Application at issues.joomla.org/joomla-cms/8714.
| Status | Pending | ⇒ | Ready to Commit |
| Milestone |
Removed: |
||
| Labels |
Added:
?
|
||
| Milestone |
Added: |
||
Can you deprecate createToken please in favour of JUserHelper::genRandomPassword()?
No. It enables the session API to continue to internally use its own token method (even if it's just a proxy now) without hardcoding the reference to generate them in case it ever needed to change to a different implementation.
rdeutz
- | Status | Ready to Commit | ⇒ | Closed |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2016-01-08 09:46:22 |
| Closed_By | ⇒ | rdeutz |
| Labels |
Removed:
?
|
||
random_bytes is PHP7 only though... :)