use hash_equals to compare hashes

493f568c · Daniel Ruf · f9022924 · 493f568c
Commit 493f568c authored Feb 24, 2016 by Daniel Ruf
Hide whitespace changes
Inline Side-by-side

Showing with 1 additions and 1 deletions

account.php qa-include/pages/account.php +1 -1

No files found.
--- a/qa-include/pages/account.php
+++ b/qa-include/pages/account.php
@@ -210,7 +210,7 @@

 			else {
 				$errors = array();
-				$legacyPassError = strtolower(qa_db_calc_passcheck($inoldpassword, $useraccount['passsalt'])) != strtolower($useraccount['passcheck']);
+				$legacyPassError = !hash_equals(strtolower($useraccount['passcheck']), strtolower(qa_db_calc_passcheck($inoldpassword, $useraccount['passsalt'])));

 				if (QA_PASSWORD_HASH) {
 					$passError = !password_verify($inoldpassword,$useraccount['passhash']);