Check strings using hash_equals

time-constant string comparison to prevent timing attacks
BIOSTALL · Jan 19, 2015 · 2d97498 · 2d97498
1 parent 512d77f
commit 2d97498
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/includes/api/class-wc-api-authentication.php b/includes/api/class-wc-api-authentication.php
@@ -190,7 +190,7 @@ private function get_user_by_consumer_key( $consumer_key ) {
 	 */
 	private function is_consumer_secret_valid( WP_User $user, $consumer_secret ) {
 
-		return $user->woocommerce_api_consumer_secret === $consumer_secret;
+		return hash_equals( $user->woocommerce_api_consumer_secret, $consumer_secret );
 	}
 
 	/**
@@ -246,7 +246,7 @@ private function check_oauth_signature( $user, $params ) {
 
 		$signature = base64_encode( hash_hmac( $hash_algorithm, $string_to_sign, $user->woocommerce_api_consumer_secret, true ) );
 
-		if ( $signature !== $consumer_signature ) {
+		if ( ! hash_equals( $signature, $consumer_signature ) ) {
 			throw new Exception( __( 'Invalid Signature - provided signature does not match', 'woocommerce' ), 401 );
 		}
 	}