mirror/php-phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-04-20 07:42:09 +02:00
Code Issues Releases Wiki Activity

[ticket/13917] Do not pass non-string variables to hash_equals()

Browse Source 
PHPBB3-13917
This commit is contained in:
Marc Alexander 2015-06-04 17:16:22 +02:00
parent 852337cacd
commit fb94bd11fb
1 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
phpBB/phpbb/passwords/driver/helper.php
View File

@ -153,17 +153,23 @@ class helper
*/
public function string_compare($string_a, $string_b)
{
// Return if input variables are not strings or if length does not match
if (!is_string($string_a) || !is_string($string_b) || strlen($string_a) != strlen($string_b))
{
return false;
}
// Use hash_equals() if it's available
if (function_exists('hash_equals'))
{
return hash_equals($string_a, $string_b);
}
$difference = strlen($string_a) != strlen($string_b);
$difference = 0;
for ($i = 0; $i < strlen($string_a) && $i < strlen($string_b); $i++)
{
$difference |= $string_a[$i] != $string_b[$i];
$difference |= ord($string_a[$i]) ^ ord($string_b[$i]);
}
return $difference === 0;