Skip to content

Commit 1b11917

Browse files
authored
Fix CSRF hash regeneration
For CSRF hash regeneration, $this->CSRFHash must be set to NULL when user set $this->CSRFRegenerate to TRUE, because in CSRFSetHash() you compare it with NULL, but $this->CSRFHash !== NULL after request.
1 parent cb3616f commit 1b11917

1 file changed

Lines changed: 1 addition & 0 deletions

File tree

system/Security/Security.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -221,6 +221,7 @@ public function CSRFVerify(RequestInterface $request)
221221
if ($this->CSRFRegenerate)
222222
{
223223
// Nothing should last forever
224+
$this->CSRFHash = null;
224225
unset($_COOKIE[$this->CSRFCookieName]);
225226
}
226227

0 commit comments

Comments
 (0)