Merge pull request #5719 from erasche/constant-time-sha-compare

Swap for the constant time comparison algorithm
2026-09-24 16:30:27 +08:00 · 2018-03-19 09:52:52 -04:00
parent 8e95830bca c73c713043
commit dbf6f58251
1 changed files with 1 additions and 1 deletions
@@ -31,7 +31,7 @@ def check_password(guess, hashed):
            return True
    else:
        # Passwords were originally encoded with sha1 and hexed
-        if hashlib.sha1(guess).hexdigest() == hashed:
+        if safe_str_cmp(hashlib.sha1(guess).hexdigest(), hashed):
            return True
    # Password does not match
    return False