gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Use hash_equals for comparing token

Browse Source 
Signed-off-by: Michal Čihař <michal@cihar.com>
This commit is contained in:
Michal Čihař 2016-01-18 09:49:15 +01:00
parent 27eb98faed
commit fe62b69a5b
2 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
libraries/common.inc.php
View File

@ -482,7 +482,7 @@ if (PMA_checkPageValidity($_REQUEST['back'], $goto_whitelist)) {
*/
$token_mismatch = true;
if (PMA_isValid($_REQUEST['token'])) {
$token_mismatch = ($_SESSION[' PMA_token '] != $_REQUEST['token']);
$token_mismatch = ! hash_equals($_SESSION[' PMA_token '], $_REQUEST['token']);
}
if ($token_mismatch) {

10
libraries/core.lib.php
View File

@ -305,7 +305,7 @@ function PMA_warnMissingExtension($extension, $fatal = false, $extra = '')
PMA_fatalError($message);
} else {
$GLOBALS['error_handler']->addError(
$message,
$message,
E_USER_WARNING,
'',
'',
@ -799,4 +799,12 @@ function PMA_addJSVar($key, $value, $escape = true)
PMA_addJSCode(PMA_getJsValue($key, $value, $escape));
}
/* Compatibility with PHP < 5.6 */
if(! function_exists('hash_equals')) {
function hash_equals($a, $b) {
$ret = strlen($a) ^ strlen($b);
$ret |= array_sum(unpack("C*", $a ^ $b));
return ! $ret;
}
}
?>