revi-archive/phorge-phorge
1
0
Fork 0
mirror of https://we.phorge.it/source/phorge.git synced 2025-03-08 10:24:48 +01:00
Code Issues Releases Wiki Activity
No description
7090 commits 3 branches 7 tags 154 MiB
PHP 93.5%
JavaScript 4.1%
CSS 2.4%
Find a file
epriestley ab7d89edc8 Use better secrets in generating account tokens 
Summary:
When we generate account tokens for CSRF keys and email verification, one of the inputs we use is the user's password hash. Users won't always have a password hash, so this is a weak input to key generation. This also couples CSRF weirdly with auth concerns.

Instead, give users a dedicated secret for use in token generation which is used only for this purpose.

Test Plan:
  - Ran upgrade scripts.
  - Verified all users got new secrets.
  - Created a new user.
  - Verified they got a secret.
  - Submitted CSRF'd forms, they worked.
  - Adjusted the CSRF token and submitted CSRF'd forms, verified they don't work.

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: epriestley

Differential Revision: https://secure.phabricator.com/D8748
2014-04-10 11:45:10 -07:00
bin Write a very basic string extractor 2014-02-05 11:02:41 -08:00
conf Remove DifferentialFieldSelector 2014-03-11 13:02:13 -07:00
externals Fix phpmailer-lite bug 2014-02-20 17:24:51 -08:00
resources Use better secrets in generating account tokens 2014-04-10 11:45:10 -07:00
scripts Remove nonfunctional/obsolete 'reconcile.php' 2014-04-09 16:12:29 -07:00
src Use better secrets in generating account tokens 2014-04-10 11:45:10 -07:00
support Disable rate limiting by default in general 2014-04-09 11:52:34 -07:00
webroot Better mobile display of ObjectItemView 2014-04-10 11:23:38 -07:00
.arcconfig Updated .arcconfig to match newer style configuration. 2014-02-25 07:48:30 -08:00
.editorconfig Specify config for text editors 2012-11-03 22:34:44 -07:00
.gitignore Rate limit requests by IP 2014-04-08 18:36:21 -07:00
LICENSE Delete license headers from files 2012-11-05 11:16:51 -08:00
NOTICE Increment year. 2013-01-03 05:45:08 -08:00
README Modernize README 2014-01-24 12:28:54 -08:00

README 

Phabricator is an open source collection of web applications which help
software companies build better software.

Phabricator includes applications for:

  - reviewing and auditing source code;
  - hosting and browsing repositories;
  - assembling a party to venture forth;
  - tracking bugs;
  - hiding stuff from coworkers; and
  - also some other things.

You can learn more about the project (and find links to documentation and
resources) here:

  http://phabricator.org/

Phabricator is developed and maintained by Phacility. The first version of
Phabricator was originally built at Facebook.

LICENSE

Phabricator is released under the Apache 2.0 license except as otherwise noted.