[web-downloads] main: Use hash_equals in Auth::authenticate
| From: | Shivam Mathur | Date: | Thu, 02 Apr 2026 01:27:56 +0000 |
| Subject: | [web-downloads] main: Use hash_equals in Auth::authenticate | ||
| Groups: | php.webmaster | ||
| Request: | Send a blank email to php-webmaster+get-33633@lists.php.net to get a copy of this message | ||
Author: Shivam Mathur (shivammathur)
Date: 2026-04-02T06:11:46+05:30
Commit: https://github.com/php/web-downloads/commit/c27dc6873177020acc202a2e2b1e247608fbba1f
Raw diff: https://github.com/php/web-downloads/commit/c27dc6873177020acc202a2e2b1e247608fbba1f.diff
Use hash_equals in Auth::authenticate
Changed paths:
M src/Auth.php
Diff:
diff --git a/src/Auth.php b/src/Auth.php
index dd7b609..a352928 100644
--- a/src/Auth.php
+++ b/src/Auth.php
@@ -10,6 +10,6 @@ public function authenticate(): bool
$authHeader = $_SERVER['HTTP_AUTHORIZATION'] ?? '';
$authToken = str_replace('Bearer ', '', $authHeader);
- return $authToken === getenv('AUTH_TOKEN');
+ return hash_equals((string) getenv('AUTH_TOKEN'), $authToken);
}
}