Make authentication timing-safe

Improve the authentication to make it timing-safe against bruteforce
attacks.

See code comments for more details on the implementation.

1 files changed, 2 insertions, 1 deletions

diff --git a/admin/inc/auth.inc.php b/admin/inc/auth.inc.php
index 1640cb0..db6e571 100644
--- a/admin/inc/auth.inc.php
+++ b/admin/inc/auth.inc.php
@@ -1,8 +1,9 @@
 <?php
 
 include dirname(__FILE__).'/pwd.inc.php';
+require_once __DIR__.'/../../app/classes/Planet.class.php';
 
-if (!isset($_COOKIE['auth']) || $_COOKIE['auth'] !== $password) {
+if (!Planet::authenticateUser($_COOKIE['auth'], $password)) {
     setcookie('auth', '', time() - 3600);
     header('Location: login.php');
     die();