diff options
| author | Tristan Darricau <tristan.darricau@sensiolabs.com> | 2015-06-06 11:45:22 +0200 |
|---|---|---|
| committer | Tristan Darricau <tristan.darricau@sensiolabs.com> | 2015-06-06 11:45:22 +0200 |
| commit | bed8df20d20ebc51046a0f6dde237ffc8f2ff67d (patch) | |
| tree | 4243e1ee6459b03c97bc9e527543525478037eb1 /phpBB | |
| parent | 593c7ed0e45b4873af9d353db53c14054dd7055e (diff) | |
| parent | fb94bd11fbffb1342cb094e76899a01180d56917 (diff) | |
| download | forums-bed8df20d20ebc51046a0f6dde237ffc8f2ff67d.tar forums-bed8df20d20ebc51046a0f6dde237ffc8f2ff67d.tar.gz forums-bed8df20d20ebc51046a0f6dde237ffc8f2ff67d.tar.bz2 forums-bed8df20d20ebc51046a0f6dde237ffc8f2ff67d.tar.xz forums-bed8df20d20ebc51046a0f6dde237ffc8f2ff67d.zip | |
Merge pull request #3680 from marc1706/ticket/13917
[ticket/13917] Use hash_equals() if possible in password driver helper
Diffstat (limited to 'phpBB')
| -rw-r--r-- | phpBB/phpbb/passwords/driver/helper.php | 16 |
1 files changed, 14 insertions, 2 deletions
diff --git a/phpBB/phpbb/passwords/driver/helper.php b/phpBB/phpbb/passwords/driver/helper.php index caa65080ac..f80c3e3df6 100644 --- a/phpBB/phpbb/passwords/driver/helper.php +++ b/phpBB/phpbb/passwords/driver/helper.php @@ -153,11 +153,23 @@ class helper */ public function string_compare($string_a, $string_b) { - $difference = strlen($string_a) != strlen($string_b); + // Return if input variables are not strings or if length does not match + if (!is_string($string_a) || !is_string($string_b) || strlen($string_a) != strlen($string_b)) + { + return false; + } + + // Use hash_equals() if it's available + if (function_exists('hash_equals')) + { + return hash_equals($string_a, $string_b); + } + + $difference = 0; for ($i = 0; $i < strlen($string_a) && $i < strlen($string_b); $i++) { - $difference |= $string_a[$i] != $string_b[$i]; + $difference |= ord($string_a[$i]) ^ ord($string_b[$i]); } return $difference === 0; |