rocklegend-org/website

hardcoded secret in ProfileController

Closed this issue · 2 comments

DanielRuf commented

Is there a reason why this is hardcoded in the file?

https://github.com/rocklegend-org/website/blob/master/app/Http/Controllers/ProfileController.php#L244

Seems this is connected to the JSConnect class, SHA-1 would be better than MD5 but both are still very weak. If possible we should move to hash('sha256').

flipace commented

Yes, this was used for the Vanilla Forum software a long time ago. It's deprecated and can be kicked out either way.

DanielRuf commented

Is this still relevant?