epriestley 29948eaa5b Use phutil_hashes_are_identical() when comparing hashes in Phabricator ...

Summary: See D14025. In all cases where we compare hashes, use strict, constant-time comparisons.

Test Plan: Logged in, logged out, added TOTP, ran Conduit, terminated sessions, submitted forms, changed password. Tweaked CSRF token, got rejected.

Reviewers: chad

Reviewed By: chad

Subscribers: chenxiruanhai

Differential Revision: https://secure.phabricator.com/D14026

2015-09-01 15:52:44 -07:00

..

config

Fix a few minor bugs in Auth Providers

2015-03-08 11:04:57 -07:00

PhabricatorAuthConfirmLinkController.php

Update Auth for handleRequest

2015-08-01 16:49:27 -07:00

PhabricatorAuthController.php

Use phutil_hashes_are_identical() when comparing hashes in Phabricator

2015-09-01 15:52:44 -07:00

PhabricatorAuthDowngradeSessionController.php

Update Auth for handleRequest

2015-08-01 16:49:27 -07:00

PhabricatorAuthFinishController.php

Update Auth for handleRequest

2015-08-01 16:49:27 -07:00

PhabricatorAuthInviteController.php

Support invites in the registration and login flow

2015-02-11 06:06:28 -08:00

PhabricatorAuthLinkController.php

Update Auth for handleRequest

2015-08-01 16:49:27 -07:00

PhabricatorAuthLoginController.php

Update Auth for handleRequest

2015-08-01 16:49:27 -07:00

PhabricatorAuthNeedsApprovalController.php

Update Auth for handleRequest

2015-08-01 16:49:27 -07:00

PhabricatorAuthNeedsMultiFactorController.php

Update Auth for handleRequest

2015-08-01 16:49:27 -07:00

PhabricatorAuthOldOAuthRedirectController.php

Update Auth for handleRequest

2015-08-01 16:49:27 -07:00

PhabricatorAuthOneTimeLoginController.php

Fix 'key'/'type' swap in email reset / one-time-login controller

2015-08-03 08:01:43 -07:00

PhabricatorAuthRegisterController.php

Update Auth for handleRequest

2015-08-01 16:49:27 -07:00

PhabricatorAuthRevokeTokenController.php

Update Auth for handleRequest

2015-08-01 16:49:27 -07:00

PhabricatorAuthSSHKeyController.php

Separate SSH key management from the settings panel

2014-11-11 08:18:26 -08:00

PhabricatorAuthSSHKeyDeleteController.php

Separate SSH key management from the settings panel

2014-11-11 08:18:26 -08:00

PhabricatorAuthSSHKeyEditController.php

Update Auth for handleRequest

2015-08-01 16:49:27 -07:00

PhabricatorAuthSSHKeyGenerateController.php

phtize all the things

2015-05-22 21:16:39 +10:00

PhabricatorAuthStartController.php

Fix a pht string

2015-06-15 18:01:09 +10:00

PhabricatorAuthTerminateSessionController.php

Use phutil_hashes_are_identical() when comparing hashes in Phabricator

2015-09-01 15:52:44 -07:00

PhabricatorAuthUnlinkController.php

Update Auth for handleRequest

2015-08-01 16:49:27 -07:00

PhabricatorAuthValidateController.php

Update Auth for handleRequest

2015-08-01 16:49:27 -07:00

PhabricatorDisabledUserController.php

Update Auth for handleRequest

2015-08-01 16:49:27 -07:00

PhabricatorEmailLoginController.php

Update Auth for handleRequest

2015-08-01 16:49:27 -07:00

PhabricatorEmailVerificationController.php

Update Auth for handleRequest

2015-08-01 16:49:27 -07:00

PhabricatorLogoutController.php

Update Auth for handleRequest

2015-08-01 16:49:27 -07:00

PhabricatorMustVerifyEmailController.php

Update Auth for handleRequest

2015-08-01 16:49:27 -07:00

PhabricatorRefreshCSRFController.php

Update Auth for handleRequest

2015-08-01 16:49:27 -07:00