gitea

tdsds.com/gitea

Fork 0

mirror of https://github.com/go-gitea/gitea synced 2025-12-07 13:28:25 +00:00

Commit Graph

Author	SHA1	Message	Date
leonklingeleandtechknowlogick	ef57fe4ae3	routers: do not leak secrets via timing side channel (#7364 ) * routers: do not leak secrets via timing side channel * routers/repo: do not leak secrets via timing side channel	2019-07-06 13:03:13 -04:00
leonklingeleandLunny Xiao	96b66e330b	routers/user: ensure that decryption of cookie actually suceeds (#7363 ) Previously, only the first return value of ctx.GetSuperSecureCookie was used to check whether decryption of the auth cookie succeeded. ctx.GetSuperSecureCookie also returns a second value, a boolean, indicating success or not. That value should be checked first to be on the safe side and not rely on internal logic of the encryption and decryption blackbox.	2019-07-06 23:47:09 +08:00

Author

SHA1

Message

Date

leonklingeleandtechknowlogick

ef57fe4ae3

routers: do not leak secrets via timing side channel (#7364 )

* routers: do not leak secrets via timing side channel

* routers/repo: do not leak secrets via timing side channel

2019-07-06 13:03:13 -04:00

leonklingeleandLunny Xiao

96b66e330b

routers/user: ensure that decryption of cookie actually suceeds (#7363 )

Previously, only the first return value of ctx.GetSuperSecureCookie
was used to check whether decryption of the auth cookie succeeded.
ctx.GetSuperSecureCookie also returns a second value, a boolean,
indicating success or not. That value should be checked first to
be on the safe side and not rely on internal logic of the encryption
and decryption blackbox.

2019-07-06 23:47:09 +08:00