@recaptime-dev's working patches + fork for Phorge, a community fork of Phabricator. (Upstream dev and stable branches are at upstream/main and upstream/stable respectively.)
hq.recaptime.dev/wiki/Phorge
phorge
phabricator
Use a class constant instead of a hardcoded string
Test Plan: Submitted a form - saw nothing out of ordinary.
Reviewers: #blessed_reviewers
Subscribers: epriestley
Differential Revision: https://secure.phabricator.com/D13167
authored by
Erik Fercak
and committed by
epriestley
5deaeec6
006a8779
+2
-1
+2
-1
src/applications/people/storage/PhabricatorUser.php
+2
-1
src/applications/people/storage/PhabricatorUser.php
···
355
355
// discussion in T3684.
356
356
$token = $this->getRawCSRFToken();
357
357
$hash = PhabricatorHash::digest($token, $salt);
358
-
return 'B@'.$salt.substr($hash, 0, self::CSRF_TOKEN_LENGTH);
358
+
return self::CSRF_BREACH_PREFIX.$salt.substr(
359
+
$hash, 0, self::CSRF_TOKEN_LENGTH);
359
360
}
360
361
361
362
public function validateCSRFToken($token) {