From bdd5c862b4e1b007d4a0992b8470ab76acea99a0 Mon Sep 17 00:00:00 2001 From: Oleksandr Piskun Date: Thu, 15 Oct 2026 07:50:33 +0000 Subject: [PATCH] refactor(harp): compare the HaRP shared key with hash_equals Signed-off-by: Oleksandr Piskun --- lib/Controller/HarpController.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/Controller/HarpController.php b/lib/Controller/HarpController.php index be3d2814f..bb91d700e 100644 --- a/lib/Controller/HarpController.php +++ b/lib/Controller/HarpController.php @@ -58,7 +58,7 @@ private function validateHarpSharedKey(ExApp $exApp): bool { } $headerHarpKey = $this->request->getHeader('HARP-SHARED-KEY'); - if ($headerHarpKey === '' || $headerHarpKey !== $harpKey) { + if ($headerHarpKey === '' || !hash_equals($harpKey, $headerHarpKey)) { $this->logger->error('Harp shared key is not valid'); $this->throttler->registerAttempt(Application::APP_ID, $this->request->getRemoteAddress(), [ 'appid' => $exApp->getAppid(),