X-Git-Url: http://git.meshlink.io/?a=blobdiff_plain;f=src%2Finvitation.c;h=5175ba92003c07be3c2a6a37833bc9d786db2126;hb=9699f08afc6420d2bdac1063ea6789b585aaf42e;hp=749870458e61a7ec9f3292af831c9d2401bc6d05;hpb=5dec1c25713a19c49fcbb885200184a9682ef175;p=meshlink

diff --git a/src/invitation.c b/src/invitation.c
index 74987045..5175ba92 100644
--- a/src/invitation.c
+++ b/src/invitation.c
@@ -349,10 +349,19 @@ int cmd_invite(int argc, char *argv[]) {
 	// Create a random cookie for this invitation.
 	char cookie[25];
 	randomize(cookie, 18);
+
+	// Create a filename that doesn't reveal the cookie itself
+	char buf[18 + strlen(fingerprint)];
+	char cookiehash[25];
+	memcpy(buf, cookie, 18);
+	memcpy(buf + 18, fingerprint, sizeof buf - 18);
+	digest_create(digest, buf, sizeof buf, cookiehash);
+	b64encode_urlsafe(cookiehash, cookiehash, 18);
+
 	b64encode_urlsafe(cookie, cookie, 18);
 
 	// Create a file containing the details of the invitation.
-	xasprintf(&filename, "%s" SLASH "invitations" SLASH "%s", confbase, cookie);
+	xasprintf(&filename, "%s" SLASH "invitations" SLASH "%s", confbase, cookiehash);
 	int ifd = open(filename, O_RDWR | O_CREAT | O_EXCL, 0600);
 	if(!ifd) {
 		fprintf(stderr, "Could not create invitation file %s: %s\n", filename, strerror(errno));