Increase CSRF token validity window to 12 hours

People leave their window open for a while, and that's fine.

1 files changed, 2 insertions, 4 deletions

diff --git a/lib/VNWeb/Auth.pm b/lib/VNWeb/Auth.pm
index 9e26d123..56367397 100644
--- a/lib/VNWeb/Auth.pm
+++ b/lib/VNWeb/Auth.pm
@@ -262,12 +262,10 @@ sub csrftoken {
 
 
 # Returns 1 if the given CSRF token is still valid (meaning: created for this
-# user within the past 3 hours), 0 otherwise.
+# user within the past 12 hours), 0 otherwise.
 sub csrfcheck {
     my($self, $token) = @_;
-    return 1 if $self->csrftoken( 0) eq $token;
-    return 1 if $self->csrftoken(-1) eq $token;
-    return 1 if $self->csrftoken(-2) eq $token;
+    $self->csrftoken($_) eq $token && return 1 for reverse -11..0;
     return 0;
 }