- 🇫🇷France prudloff Lille
Is there any reason to truncate the hash in ImageStyle::getPathToken()?
Would using the whole hash cause problems?
As computing power improves, the ability to brute force the token to bypass access increases.
This issue was reported privately to the Drupal security team who decided this could be solved in public as a hardening
Increase the length of the itok token
Active
11.0 🔥
image.module
It makes Drupal less vulnerable to abuse or misuse. Note, this is the preferred tag, though the Security tag has a large body of issues tagged to it. Do NOT publicly disclose security vulnerabilities; contact the security team instead. Anyone (whether security team or not) can apply this tag to security improvements that do not directly present a vulnerability e.g. hardening an API to add filtering to reduce a common mistake in contributed modules.
Not all content is available!
It's likely this issue predates Contrib.social: some issue and comment data are missing.
Is there any reason to truncate the hash in ImageStyle::getPathToken()?
Would using the whole hash cause problems?