7 Commits

Author	SHA1	Message	Date
irdc	4b76bc5b32	Use a HMAC to sign and validate CSRF tokens, instead of generating random ones and storing them in the session data ... * Use a HMAC to sign and validate CSRF tokens, instead of generating random ones and storing them in the session data. Reduces number of writes to sessions table and fixes kanboard issue #4942. * Added missing CSRF check for starting/stopping subtask timers. Co-authored-by: Willemijn Coene <willemijn@irdc.nl>	2022-09-17 17:23:41 -07:00
Frédéric Guillot	9ddefa979a	Add CSRF check for task and project files upload	2018-01-29 15:56:30 -08:00
Frédéric Guillot	ccd177ada6	Store PHP sessions in the database	2017-12-12 15:04:28 -08:00
Frederic Guillot	e62779e267	Improve 2FA	2016-01-05 20:31:15 -05:00
Frederic Guillot	4358708f1b	Use PHP7 function random_bytes() to generate tokens if available	2015-11-15 16:31:26 -05:00
Frederic Guillot	a675271ad7	Rewrite of session management	2015-11-15 12:50:33 -05:00
Frederic Guillot	6756ef2301	Move token generation to Security namespace	2015-10-25 15:05:19 -04:00