php/yii2
1
0
Fork 0
mirror of https://github.com/yiisoft/yii2.git synced 2025-11-27 04:10:30 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fixes #1634: Use masked CSRF tokens to prevent BREACH exploits

Browse Source
This commit is contained in:
Qiang Xue
2013-12-26 17:51:14 -05:00
parent 2686403c0e
commit c8960168c5
4 changed files with 60 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
framework/yii/web/View.php
View File

@@ -388,7 +388,7 @@ class View extends \yii\base\View
$request = Yii::$app->getRequest();
if ($request instanceof \yii\web\Request && $request->enableCsrfValidation) {
$lines[] = Html::tag('meta', '', ['name' => 'csrf-var', 'content' => $request->csrfVar]);
$lines[] = Html::tag('meta', '', ['name' => 'csrf-token', 'content' => $request->getCsrfToken()]);
$lines[] = Html::tag('meta', '', ['name' => 'csrf-token', 'content' => $request->getMaskedCsrfToken()]);
}
if (!empty($this->linkTags)) {