D13151.diff
No OneTemporary
Actions

Size

1 KB

Referenced Files

None

Subscribers

None

D13151.diff
View Options

	diff --git a/src/applications/people/storage/PhabricatorUser.php b/src/applications/people/storage/PhabricatorUser.php
	--- a/src/applications/people/storage/PhabricatorUser.php
	+++ b/src/applications/people/storage/PhabricatorUser.php
	@@ -59,6 +59,7 @@

	private $authorities = array();
	private $handlePool;
	+ private $csrfSalt;

	protected function readField($field) {
	switch ($field) {
	@@ -342,16 +343,14 @@
	self::CSRF_TOKEN_LENGTH);
	}

	- /**
	- * @phutil-external-symbol class PhabricatorStartup
	- */
	public function getCSRFToken() {
	- $salt = PhabricatorStartup::getGlobal('csrf.salt');
	- if (!$salt) {
	- $salt = Filesystem::readRandomCharacters(self::CSRF_SALT_LENGTH);
	- PhabricatorStartup::setGlobal('csrf.salt', $salt);
	+ if ($this->csrfSalt === null) {
	+ $this->csrfSalt = Filesystem::readRandomCharacters(
	+ self::CSRF_SALT_LENGTH);
	}

	+ $salt = $this->csrfSalt;
	+
	// Generate a token hash to mitigate BREACH attacks against SSL. See
	// discussion in T3684.
	$token = $this->getRawCSRFToken();