use fixed msg for key derivation

3 years ago · 8b71a92219
parent 6740c77e43
commit 8b71a92219
1 changed files with 1 additions and 1 deletions
--- a/core/admin/mailu/utils.py
+++ b/core/admin/mailu/utils.py
@ -280,7 +280,7 @@ class MailuSessionConfig:

        key = want_bytes(app.secret_key)

-        self._hmac    = hmac.new(hmac.digest(key, key, digest='sha256'), digestmod='sha256')
+        self._hmac    = hmac.new(hmac.digest(key, b'SESSION_UID_HASH', digest='sha256'), digestmod='sha256')
        self._uid_len = uid_bytes
        self._uid_b64 = len(self._encode(bytes(uid_bytes)))
        self._sid_len = sid_bytes