From 7c8038f0a96f6841fa4ce97e3651415dd28f2c33 Mon Sep 17 00:00:00 2001 From: Oleksandr Piskun Date: Thu, 15 Oct 2026 07:50:35 +0000 Subject: [PATCH] refactor(harp): compare the HaRP shared key with hash_equals Signed-off-by: Oleksandr Piskun --- lib/Controller/HarpController.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/Controller/HarpController.php b/lib/Controller/HarpController.php index 340a16a7f..f4f78a6c1 100644 --- a/lib/Controller/HarpController.php +++ b/lib/Controller/HarpController.php @@ -57,7 +57,7 @@ private function validateHarpSharedKey(ExApp $exApp): bool { } $headerHarpKey = $this->request->getHeader('HARP-SHARED-KEY'); - if ($headerHarpKey === '' || $headerHarpKey !== $harpKey) { + if ($headerHarpKey === '' || !hash_equals($harpKey, $headerHarpKey)) { $this->logger->error('Harp shared key is not valid'); $this->throttler->registerAttempt(Application::APP_ID, $this->request->getRemoteAddress(), [ 'appid' => $exApp->getAppid(),