mirror of
https://codeberg.org/PostERG/xamxam.git
synced 2026-06-25 16:19:19 +02:00
f398a0f1ff
- account.php: replace !== CSRF token check with hash_equals - ShareLink::setPassword(): also encrypt and store plain-text password alongside the hash, matching create() behavior so the decrypted_password decoration stays correct after password updates
6 lines
337 B
Markdown
6 lines
337 B
Markdown
# TODO
|
|
|
|
- [x] Fix `account.php`: replace `!==` CSRF token check with `hash_equals` (constant-time comparison)
|
|
- [x] Fix `ShareLink::setPassword()`: also encrypt and store plain-text password, matching `create()` behavior
|
|
- [x] Audit: confirm all remaining credential comparison sites use constant-time `hash_equals` or `password_verify`
|