[SECURITY] Use signed storage PID during frontend authentication (640a6f62) · Commits · TYPO3 / TYPO3.CMS

Commit 640a6f62 authored 2 years ago by

Oliver Hader Committed by Oliver Hader 2 years ago

[SECURITY] Use signed storage PID during frontend authentication

This change ensures that individual storage page ids are
valid by signing corresponding values with an HMAC.

Resolves: #98010
Releases: main, 11.5, 10.4
Change-Id: I34d474ab23adca6bbcf20c108bb60acf6998bc6f
Security-Bulletin: TYPO3-CORE-SA-2022-013
Security-References: CVE-2022-23501
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77090


Reviewed-by: Oliver Hader <oliver.hader@typo3.org>
Tested-by: Oliver Hader <oliver.hader@typo3.org>

parent 1e5f4441

No related merge requests found

Hide whitespace changes

Inline Side-by-side

Showing with 21 additions and 5 deletions

Please register or to comment