Timing attack fix from security experts https://arcturussecurity.com

outroll · Oct 17, 2018 · 5f68c1b · sentabi · Oct 18, 2018 · 5f68c1b
1 parent 67a0e8d
commit 5f68c1b
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/web/reset/index.php b/web/reset/index.php
@@ -48,7 +48,7 @@
         if ( $return_var == 0 ) {
             $data = json_decode(implode('', $output), true);
             $rkey = $data[$user]['RKEY'];
-            if ($rkey == $_POST['code']) {
+            if (hash_equals($rkey, $POST[‘code’])) {
                 $v_password = tempnam("/tmp","vst");
                 $fp = fopen($v_password, "w");
                 fwrite($fp, $_POST['password']."\n");