{"shas":[["d8b85b633f7cbd7d28675af4da16c7a002e67e1f","96301cf1f15ed4b00d9dee8316c647e07e82e9af@typo3.org","[BUGFIX] Abandon one time CSRF tokens\n\nAbandon the extra security feature of having one time tokens and create tokens\nwhich are valid during a whole login session. Additionally create only one random token,\nstore it in the session and create the real URL and form tokens by hashing the scope strings\nwith the secret session token.\n\nTo enable re-login, store the session token in the registry and retrieve it in case a\nre-login happens.\n\nThanks to Marion Eher (Bluechip.at) for sponsoring\nthis fix with 75 beers during the bug auction at T3BOARD11.\n\nResolves: #25359\nChange-Id: If37990fbc1ae3701777e8218cc1bc8760a4d6a55\nReleases: 4.6, 4.5\nReviewed-on: http://review.typo3.org/1364\nReviewed-by: Helmut Hummel\nTested-by: Helmut Hummel","Helmut Hummel"]],"repo":"typo3/TYPO3v4-Core","actor":"t3dev","ref":"refs/heads/master","size":1,"head":"d8b85b633f7cbd7d28675af4da16c7a002e67e1f","actor_gravatar":"96a5c3d942902e2d967a41355fa4060b","push_id":30203026}