![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png){kind=logo}
Opened 10 years ago
Closed 10 years ago
#37324 closed defect (bug) (fixed)
Use hash_equals() when comparing hashes
| Reported by: | ocean90 | Owned by: | ocean90 |
|---|---|---|---|
| Priority: | normal | Milestone: | 4.6 |
| Component: | Security | Version: | |
| Severity: | normal | Keywords: | has-patch |
| Cc: | Focuses: | multisite |
Description
For hardening purposes we should use hash_equals() whenever we compare a (password) hash against user input.hash_equals() does a timing attack safe string comparison.
Attachments (1)
Change History (2)
Note:
See TracTickets
for help on using tickets.
In 38032: