mirror of
https://codeberg.org/forgejo/forgejo.git
synced 2024-12-23 10:54:17 +01:00
Safe compare password (timing attack) (#338)
This commit is contained in:
parent
db6a4e9fbf
commit
c8f300b2cd
1 changed files with 2 additions and 1 deletions
|
@ -8,6 +8,7 @@ import (
|
||||||
"bytes"
|
"bytes"
|
||||||
"container/list"
|
"container/list"
|
||||||
"crypto/sha256"
|
"crypto/sha256"
|
||||||
|
"crypto/subtle"
|
||||||
"encoding/hex"
|
"encoding/hex"
|
||||||
"errors"
|
"errors"
|
||||||
"fmt"
|
"fmt"
|
||||||
|
@ -368,7 +369,7 @@ func (u *User) EncodePasswd() {
|
||||||
func (u *User) ValidatePassword(passwd string) bool {
|
func (u *User) ValidatePassword(passwd string) bool {
|
||||||
newUser := &User{Passwd: passwd, Salt: u.Salt}
|
newUser := &User{Passwd: passwd, Salt: u.Salt}
|
||||||
newUser.EncodePasswd()
|
newUser.EncodePasswd()
|
||||||
return u.Passwd == newUser.Passwd
|
return subtle.ConstantTimeCompare([]byte(u.Passwd), []byte(newUser.Passwd)) == 1
|
||||||
}
|
}
|
||||||
|
|
||||||
// UploadAvatar saves custom avatar for user.
|
// UploadAvatar saves custom avatar for user.
|
||||||
|
|
Loading…
Reference in a new issue