[TYPO3-dev] cHash cache length

[Richard Davies]

Hi Helmut,

Makes sense. I understood it was calculated from the encryption key but
thought it may have used some sort of salt.

Thanks for the clarification
Richard

On 23 December 2014 at 04:00, Helmut Hummel <helmut.hummel at typo3.org> wrote:

> Hi Richard!
>
> Am 22.12.14 um 00:40 schrieb Richard Davies:
>
>  My extension emails out a list of download links to customers that are
>> never generated again / listed anywhere. They include cHash links. Do
>> cHash
>> links expire? Or only when the Typo3 cache is cleared? Or only when the
>> install tool clear cache button is clicked?
>>
>
> The cHash is calculated from the keys and values of the GET arguments in
> the URL *and* the Encryption key. This means the cHash stays valid as long
> as the encryption key stays the same. Clearing *any* cache does *not*
> invalidate a cHash.
>
> Kind regards,
> Helmut
>
> --
> Helmut Hummel
> Release Manager TYPO3 6.0
> TYPO3 CMS Active Contributor, TYPO3 Security Team Member
>
> TYPO3 .... inspiring people to share!
> Get involved: typo3.org
>
> _______________________________________________
> TYPO3-dev mailing list
> TYPO3-dev at lists.typo3.org
> http://lists.typo3.org/cgi-bin/mailman/listinfo/typo3-dev
>