Changeset 14583

Timestamp:

10/31/2025 05:52:50 AM (3 months ago)

Author:

dd32

Message:

Slack: Use hahs_equals() when comparing webhook tokens.

Location:

sites/trunk/api.wordpress.org/public_html/dotorg/slack

Files:

• announce.php (modified) (1 diff)
• committers.php (modified) (1 diff)
• security-team.php (modified) (1 diff)
• subgroup.php (modified) (1 diff)
• trac-bot.php (modified) (1 diff)

sites/trunk/api.wordpress.org/public_html/dotorg/slack/announce.php

@@ -30 +30 @@
 // WEBHOOK_TOKEN_1, WEBHOOK_TOKEN_2, etc.
 while ( defined( __NAMESPACE__ . '\\WEBHOOK_TOKEN_' . ++$i ) ) {
-    if ( constant( __NAMESPACE__ . '\\WEBHOOK_TOKEN_' . $i ) === $_POST['token'] ) {
+    if ( hash_equals( constant( __NAMESPACE__ . '\\WEBHOOK_TOKEN_' . $i ), $_POST['token'] ) ) {
         run( $_POST );
     }

sites/trunk/api.wordpress.org/public_html/dotorg/slack/committers.php

@@ -7 +7 @@
 require dirname( dirname( __DIR__ ) ) . '/includes/slack-config.php';
 
-if ( $_POST['token'] !== WEBHOOK_TOKEN ) {
+if ( ! hash_equals( WEBHOOK_TOKEN, $_POST['token'] ) ) {
     return;
 }

sites/trunk/api.wordpress.org/public_html/dotorg/slack/security-team.php

@@ -63 +63 @@
 
     // Confirm it came from the Trac server.
-    if ( $_GET['token'] !== API_TOKEN ) {
+    if ( ! hash_equals( API_TOKEN, $_GET['token'] ?? '' ) ) {
         exit;
     }

sites/trunk/api.wordpress.org/public_html/dotorg/slack/subgroup.php

@@ -48 +48 @@
 
 // Confirm it came from Slack.
-if ( $_POST['token'] !== WEBHOOK_TOKEN ) {
+if ( ! hash_equals( WEBHOOK_TOKEN, $_POST['token'] ?? '' ) ) {
     die( "Invalid Token" );
 }

sites/trunk/api.wordpress.org/public_html/dotorg/slack/trac-bot.php

@@ -12 +12 @@
 
     // Verify it came from Slack.
-    if ( ! isset( $_GET['token'] ) || $_GET['token'] !== URL_SECRET__TRAC_BOT ) {
+    if ( ! hash_equals( URL_SECRET__TRAC_BOT, $_GET['token'] ?? '' ) ) {
         return;
     }