From cdcd66dfc2bcf16e481d10bfa2d3ff1b4d433f99 Mon Sep 17 00:00:00 2001
From: Andreas Gohr <andi@splitbrain.org>
Date: Fri, 31 May 2013 09:22:45 +0200
Subject: use hmac for external ressource hash FS#2794

---
 inc/fetch.functions.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'inc/fetch.functions.php')

diff --git a/inc/fetch.functions.php b/inc/fetch.functions.php
index 5801e96fa..ea524a37a 100644
--- a/inc/fetch.functions.php
+++ b/inc/fetch.functions.php
@@ -99,7 +99,7 @@ function checkFileStatus(&$media, &$file, $rev = '', $width=0, $height=0) {
     //media to local file
     if(preg_match('#^(https?)://#i', $media)) {
         //check hash
-        if(substr(md5(auth_cookiesalt().$media), 0, 6) !== $INPUT->str('hash')) {
+        if(substr(PassHash::hmac('md5', $media, auth_cookiesalt()), 0, 6) !== $INPUT->str('hash')) {
             return array(412, 'Precondition Failed');
         }
         //handle external images
-- 
cgit v1.2.3