Using hash_equals() to avoid timing attacks.

WordPress · Sep 26, 2023 · fc01e42 · fc01e42
1 parent ee1825f
commit fc01e42
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/public_html/wp-content/plugins/wordcamp-organizer-survey/wordcamp-organizer-survey.php b/public_html/wp-content/plugins/wordcamp-organizer-survey/wordcamp-organizer-survey.php
@@ -142,7 +142,7 @@ function validate_token_on_debrief_survey() {
 		$expected_token = hash_hmac( 'sha1', base64_decode( $wordcamp_id ), ORGANIZER_SURVEY_ACCESS_TOKEN_KEY );
 
 		// Check if the request is a form submission. If not, then validate the token.
-		if ( 'POST' !== $_SERVER['REQUEST_METHOD'] && $token !== $expected_token ) {
+		if ( 'POST' !== $_SERVER['REQUEST_METHOD'] && ! hash_equals( $expected_token, $token ) ) {
 			wp_die('Invalid access token.');
 		} else {
 			$wordcamp_post_data = get_wordcamp_post(base64_decode( $wordcamp_id ));