Safe compare password (timing attack) (#338)

tokarchuk/v1.17
Denis Denisov 8 years ago committed by Lunny Xiao
parent db6a4e9fbf
commit c8f300b2cd
  1. 3
      models/user.go

@ -8,6 +8,7 @@ import (
"bytes"
"container/list"
"crypto/sha256"
"crypto/subtle"
"encoding/hex"
"errors"
"fmt"
@ -368,7 +369,7 @@ func (u *User) EncodePasswd() {
func (u *User) ValidatePassword(passwd string) bool {
newUser := &User{Passwd: passwd, Salt: u.Salt}
newUser.EncodePasswd()
return u.Passwd == newUser.Passwd
return subtle.ConstantTimeCompare([]byte(u.Passwd), []byte(newUser.Passwd)) == 1
}
// UploadAvatar saves custom avatar for user.

Loading…
Cancel
Save