Merge pull request #1652 from aidantwoods/hash_equals-for-pwhash-compare

Use hash_equals when comparing to pwhash from cookie
2024-12-06 19:36:21 +01:00 · 2020-12-06 13:45:59 +00:00
parent 98059251a1 85c7a3b437
commit ec0bd75c71
1 changed files with 1 additions and 1 deletions
@@ -42,7 +42,7 @@
        // Check for and authorize from persistent cookie 
        if (isset($_COOKIE["persistentlogin"]))
        {
-            if ($pwhash === $_COOKIE["persistentlogin"])
+            if (hash_equals($pwhash, $_COOKIE["persistentlogin"]))
            {
                $auth = true;
                // Refresh cookie with new expiry