Commit 2052835d authored by Vasilii Iakliushin's avatar Vasilii Iakliushin

Merge branch '355878_use_sha256_for_lfs_token_secret' into 'master'

Use SHA256 fingerprint instead of MD5 for LFS token secret

See merge request gitlab-org/gitlab!84606
parents 103f5fbf ea76f3c2
...@@ -99,7 +99,7 @@ module Gitlab ...@@ -99,7 +99,7 @@ module Gitlab
case actor case actor
when DeployKey, Key when DeployKey, Key
# Since fingerprint is based on the public key, let's take more bytes from attr_encrypted_db_key_base # Since fingerprint is based on the public key, let's take more bytes from attr_encrypted_db_key_base
actor.fingerprint.delete(':').first(16) + Settings.attr_encrypted_db_key_base_32 actor.fingerprint_sha256.first(16) + Settings.attr_encrypted_db_key_base_32
when User when User
# Take the last 16 characters as they're more unique than the first 16 # Take the last 16 characters as they're more unique than the first 16
actor.id.to_s + actor.encrypted_password.last(16) + Settings.attr_encrypted_db_key_base.first(16) actor.id.to_s + actor.encrypted_password.last(16) + Settings.attr_encrypted_db_key_base.first(16)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment