Changeset 1948

Timestamp:

10/07/2015 12:16:59 PM (11 years ago)

Author:

kovshenin

Message:

WordCamp Payments: Use hash_equals() for hash comparison when decrypting.

File:

• sites/trunk/wordcamp.org/public_html/wp-content/plugins/wordcamp-payments/classes/encryption.php (modified) (1 diff)

sites/trunk/wordcamp.org/public_html/wp-content/plugins/wordcamp-payments/classes/encryption.php

@@ -79 +79 @@
 
                 // Verify hmac.
-                if ( $hmac !== hash_hmac( 'sha256', $data, self::$hmac_key, true ) )
+                if ( ! hash_equals( hash_hmac( 'sha256', $data, self::$hmac_key, true ), $hmac ) )
                         return new WP_Error( 'encryption-error', 'HMAC mismatch.' );