IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2025-01-10 08:03:58 -06:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3771 from bergquist/contant_time_comparison

Browse Source 
fix(login): fix vulnerbility for timing attacks
This commit is contained in:
Carl Bergquist 2016-01-18 08:44:11 +01:00
commit 9b42b33648
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
pkg/login/auth.go
View File

@ -3,6 +3,7 @@ package login
import (
"errors"
"crypto/subtle"
"github.com/grafana/grafana/pkg/bus"
m "github.com/grafana/grafana/pkg/models"
"github.com/grafana/grafana/pkg/setting"
@ -56,7 +57,7 @@ func loginUsingGrafanaDB(query *LoginUserQuery) error {
user := userQuery.Result
passwordHashed := util.EncodePassword(query.Password, user.Salt)
if passwordHashed != user.Password {
if subtle.ConstantTimeCompare([]byte(passwordHashed), []byte(user.Password)) != 1 {
return ErrInvalidCredentials
}