diff options
Diffstat (limited to 'filters/gentoo-ldap-authentication.lua')
-rw-r--r-- | filters/gentoo-ldap-authentication.lua | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/filters/gentoo-ldap-authentication.lua b/filters/gentoo-ldap-authentication.lua index 6d8eb3e..c1e382f 100644 --- a/filters/gentoo-ldap-authentication.lua +++ b/filters/gentoo-ldap-authentication.lua | |||
@@ -271,7 +271,7 @@ function validate_value(expected_field, cookie) | |||
271 | end | 271 | end |
272 | 272 | ||
273 | -- Lua hashes strings, so these comparisons are time invariant. | 273 | -- Lua hashes strings, so these comparisons are time invariant. |
274 | if hmac ~= crypto.hmac.digest("sha1", field .. "|" .. value .. "|" .. tostring(expiration) .. "|" .. salt, secret) then | 274 | if hmac ~= crypto.hmac.digest("sha256", field .. "|" .. value .. "|" .. tostring(expiration) .. "|" .. salt, secret) then |
275 | return nil | 275 | return nil |
276 | end | 276 | end |
277 | 277 | ||
@@ -296,7 +296,7 @@ function secure_value(field, value, expiration) | |||
296 | value = url_encode(value) | 296 | value = url_encode(value) |
297 | field = url_encode(field) | 297 | field = url_encode(field) |
298 | authstr = field .. "|" .. value .. "|" .. tostring(expiration) .. "|" .. salt | 298 | authstr = field .. "|" .. value .. "|" .. tostring(expiration) .. "|" .. salt |
299 | authstr = authstr .. "|" .. crypto.hmac.digest("sha1", authstr, secret) | 299 | authstr = authstr .. "|" .. crypto.hmac.digest("sha256", authstr, secret) |
300 | return authstr | 300 | return authstr |
301 | end | 301 | end |
302 | 302 | ||