make remember login token also dependent on password to protect against some brute force attacks on this token

This commit is contained in:
Robin Appelman 2011-12-14 13:26:34 +01:00
parent 5e711f37ca
commit a862fec9a3
1 changed files with 1 additions and 1 deletions

View File

@ -88,7 +88,7 @@ else {
if(defined("DEBUG") && DEBUG) {
OC_Log::write('core','Setting remember login to cookie',OC_Log::DEBUG);
}
$token = md5($_POST["user"].time());
$token = md5($_POST["user"].time().$_POST['password']);
OC_Preferences::setValue($_POST['user'], 'login', 'token', $token);
OC_User::setMagicInCookie($_POST["user"], $token);
}