Laravel cookie forgery, decryption, and RCE

Re:Laravel cookie forgery, decryption, and RCE by adamors on Sunday April 20, 2014 @05:08PM (#7618493)

As usual, HN only cares about PHP when there's some FUD to spread.

This is an old bug that was made public and fixed over a year ago [0].

[0] http://www.reddit.com/r/PHP/comments/2332gq/laravel_cookie_f...

[ Parent | on HN ]

Re:Laravel cookie forgery, decryption, and RCE by krapp on Sunday April 20, 2014 @05:30PM (#7618561)

I didn't intend to spread FUD when I posted this - I wasn't aware the equality check was also fixed. I use Laravel in a lot of projects and only saw it posted elsewhere today.

re the downvotes: fair enough I guess.

[ Parent | on HN ]

Re:Laravel cookie forgery, decryption, and RCE by ianhawes on Sunday April 20, 2014 @08:03PM (#7618974)

Just curious but where did you see this? This was posted last week on /r/php and the Laravel creator stepped in and pointed out that it was patched awhile ago.

[ Parent | on HN ]

Re:Laravel cookie forgery, decryption, and RCE by krapp on Sunday April 20, 2014 @08:06PM (#7618981)

A php group on linkedin. Probably posted from /r/php but I haven't been there in a while.

[ Parent | on HN ]