From f9634cb679f567f30cbfa1bda61193002c0ae87d Mon Sep 17 00:00:00 2001 From: Oleksandr Piskun Date: Thu, 15 Oct 2026 07:50:00 +0000 Subject: [PATCH] refactor(harp): compare the HaRP shared key with hash_equals Signed-off-by: Oleksandr Piskun --- lib/Controller/HarpController.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/Controller/HarpController.php b/lib/Controller/HarpController.php index 7f4430122..9540a058a 100644 --- a/lib/Controller/HarpController.php +++ b/lib/Controller/HarpController.php @@ -60,7 +60,7 @@ private function validateHarpSharedKey(ExApp $exApp): bool { } $headerHarpKey = $this->request->getHeader('harp-shared-key'); - if ($headerHarpKey === '' || $headerHarpKey !== $harpKey) { + if ($headerHarpKey === '' || !hash_equals($harpKey, $headerHarpKey)) { $this->logger->error('Harp shared key is not valid'); $this->throttler->registerAttempt(Application::APP_ID, $this->request->getRemoteAddress(), [ 'appid' => $exApp->getAppid(),