Prevent timing attacks on helpdesk form tokens

glpi-project · Jan 24, 2025 · 5a624f9 · 5a624f9
1 parent 576fcd0
commit 5a624f9
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/src/Glpi/Form/AccessControl/ControlType/DirectAccess.php b/src/Glpi/Form/AccessControl/ControlType/DirectAccess.php
@@ -168,7 +168,7 @@ private function validateToken(
             return false;
         }
 
-        return $config->getToken() === $token;
+        return hash_equals($config->getToken(), $token);
     }
 
     public function allowUnauthenticated(JsonFieldInterface $config): bool