IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2025-02-25 18:55:37 -06:00
Code Issues Packages Projects Releases Wiki Activity

fix(login): fix vulnerbility for timing attacks

Browse Source 
closes #3760
This commit is contained in:
bergquist 2016-01-18 08:38:32 +01:00
parent 317c5ba88d
commit 053868f593
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
pkg/login/auth.go
View File

@ -3,6 +3,7 @@ package login
import (
"errors"
"crypto/subtle"
"github.com/grafana/grafana/pkg/bus"
m "github.com/grafana/grafana/pkg/models"
"github.com/grafana/grafana/pkg/setting"
@ -56,7 +57,7 @@ func loginUsingGrafanaDB(query *LoginUserQuery) error {
user := userQuery.Result
passwordHashed := util.EncodePassword(query.Password, user.Salt)
if passwordHashed != user.Password {
if subtle.ConstantTimeCompare([]byte(passwordHashed), []byte(user.Password)) != 1 {
return ErrInvalidCredentials
}