diff --git a/typo3/sysext/backend/Classes/Controller/FileSystemNavigationFrameController.php b/typo3/sysext/backend/Classes/Controller/FileSystemNavigationFrameController.php index 85eab22c35efabe8bf3e7453aa3dafb4913d71bf..5b069f7261d1a99f9f4e6a335bbdff8c01044187 100644 --- a/typo3/sysext/backend/Classes/Controller/FileSystemNavigationFrameController.php +++ b/typo3/sysext/backend/Classes/Controller/FileSystemNavigationFrameController.php @@ -103,7 +103,7 @@ class FileSystemNavigationFrameController $scopeData = (string)GeneralUtility::_GP('scopeData'); $scopeHash = (string)GeneralUtility::_GP('scopeHash'); - if (!empty($scopeData) && GeneralUtility::hmac($scopeData) === $scopeHash) { + if (!empty($scopeData) && hash_equals(GeneralUtility::hmac($scopeData), $scopeHash)) { $this->scopeData = unserialize($scopeData); } diff --git a/typo3/sysext/backend/Classes/Controller/FormInlineAjaxController.php b/typo3/sysext/backend/Classes/Controller/FormInlineAjaxController.php index 00ef626246b2afa074f2199bcc1508d86bf75846..ef8054bae54edd618c143d30213cf1ceecb02fa9 100644 --- a/typo3/sysext/backend/Classes/Controller/FormInlineAjaxController.php +++ b/typo3/sysext/backend/Classes/Controller/FormInlineAjaxController.php @@ -743,7 +743,7 @@ class FormInlineAjaxController extends AbstractFormEngineAjaxController if (empty($context['config'])) { throw new \RuntimeException('Empty context config section given', 1489751362); } - if (!\hash_equals(GeneralUtility::hmac(json_encode($context['config']), 'InlineContext'), $context['hmac'])) { + if (!hash_equals(GeneralUtility::hmac(json_encode($context['config']), 'InlineContext'), $context['hmac'])) { throw new \RuntimeException('Hash does not validate', 1489751363); } return $context['config']; diff --git a/typo3/sysext/backend/Classes/Controller/LinkBrowserController.php b/typo3/sysext/backend/Classes/Controller/LinkBrowserController.php index 195addb427ae74a03570a9ccbf0b31a26a6dbf3f..a66951861ea89d12f2b8c8e41a3f32919832a585 100644 --- a/typo3/sysext/backend/Classes/Controller/LinkBrowserController.php +++ b/typo3/sysext/backend/Classes/Controller/LinkBrowserController.php @@ -120,7 +120,7 @@ class LinkBrowserController extends AbstractLinkBrowserController } unset($value); } - $result = $this->parameters['fieldChangeFuncHash'] === GeneralUtility::hmac(serialize($fieldChangeFunctions)); + $result = hash_equals(GeneralUtility::hmac(serialize($fieldChangeFunctions)), $this->parameters['fieldChangeFuncHash']); } return $result; } diff --git a/typo3/sysext/backend/Classes/Form/Wizard/ImageManipulationWizard.php b/typo3/sysext/backend/Classes/Form/Wizard/ImageManipulationWizard.php index 0c0d15096027d8644f7be8d32f7a179c1c4998a3..405606f14e1751ebbe43c4b8b26fe6ce1fd106c8 100644 --- a/typo3/sysext/backend/Classes/Form/Wizard/ImageManipulationWizard.php +++ b/typo3/sysext/backend/Classes/Form/Wizard/ImageManipulationWizard.php @@ -87,6 +87,6 @@ class ImageManipulationWizard protected function isSignatureValid(ServerRequestInterface $request) { $token = GeneralUtility::hmac($request->getQueryParams()['arguments'], 'ajax_wizard_image_manipulation'); - return $token === $request->getQueryParams()['signature']; + return hash_equals($token, $request->getQueryParams()['signature']); } } diff --git a/typo3/sysext/core/Classes/Controller/FileDumpController.php b/typo3/sysext/core/Classes/Controller/FileDumpController.php index ebaa9f614d8755a9e47045bdcbfba82002a0ba2e..dcd25e781b794f2353001bd0e798272fc91bba1b 100644 --- a/typo3/sysext/core/Classes/Controller/FileDumpController.php +++ b/typo3/sysext/core/Classes/Controller/FileDumpController.php @@ -55,7 +55,7 @@ class FileDumpController $parameters['p'] = $p; } - if (GeneralUtility::hmac(implode('|', $parameters), 'resourceStorageDumpFile') === $this->getGetOrPost($request, 'token')) { + if (hash_equals(GeneralUtility::hmac(implode('|', $parameters), 'resourceStorageDumpFile'), $this->getGetOrPost($request, 'token'))) { if (isset($parameters['f'])) { try { $file = ResourceFactory::getInstance()->getFileObject($parameters['f']); diff --git a/typo3/sysext/core/Classes/FormProtection/AbstractFormProtection.php b/typo3/sysext/core/Classes/FormProtection/AbstractFormProtection.php index dc634da3e583341f2c7b2a55187184d13dbd4604..a49cc6d135964c603971d710fbd74db6aa5e2a02 100644 --- a/typo3/sysext/core/Classes/FormProtection/AbstractFormProtection.php +++ b/typo3/sysext/core/Classes/FormProtection/AbstractFormProtection.php @@ -103,7 +103,7 @@ abstract class AbstractFormProtection public function validateToken($tokenId, $formName, $action = '', $formInstanceName = '') { $validTokenId = GeneralUtility::hmac(((string)$formName . (string)$action) . (string)$formInstanceName . $this->getSessionToken()); - if ((string)$tokenId === $validTokenId) { + if (hash_equals($validTokenId, (string)$tokenId)) { $isValid = true; } else { $isValid = false; diff --git a/typo3/sysext/extbase/Classes/Security/Cryptography/HashService.php b/typo3/sysext/extbase/Classes/Security/Cryptography/HashService.php index 8426306cdeb1e04fcc0e9c5ff5ae815020a79447..b5af431a4f732c4b845739341bcd3fac5ff1e47b 100644 --- a/typo3/sysext/extbase/Classes/Security/Cryptography/HashService.php +++ b/typo3/sysext/extbase/Classes/Security/Cryptography/HashService.php @@ -65,7 +65,7 @@ class HashService implements \TYPO3\CMS\Core\SingletonInterface */ public function validateHmac($string, $hmac) { - return $this->generateHmac($string) === $hmac; + return hash_equals($this->generateHmac($string), $hmac); } /** diff --git a/typo3/sysext/frontend/Classes/Controller/ShowImageController.php b/typo3/sysext/frontend/Classes/Controller/ShowImageController.php index b53b405f2505f7da7f13a5e2ad6eb550b7c5b48a..f9912cd534c23b257d73e1a82fac9c7c3153da70 100644 --- a/typo3/sysext/frontend/Classes/Controller/ShowImageController.php +++ b/typo3/sysext/frontend/Classes/Controller/ShowImageController.php @@ -120,7 +120,7 @@ EOF; /* For backwards compatibility the HMAC is transported within the md5 param */ $hmacParameter = isset($this->request->getQueryParams()['md5']) ? $this->request->getQueryParams()['md5'] : null; $hmac = GeneralUtility::hmac(implode('|', [$fileUid, $parametersEncoded])); - if ($hmac !== $hmacParameter) { + if (!hash_equals($hmac, $hmacParameter)) { throw new \InvalidArgumentException('hash does not match', 1476048456); } diff --git a/typo3/sysext/frontend/Classes/Controller/TypoScriptFrontendController.php b/typo3/sysext/frontend/Classes/Controller/TypoScriptFrontendController.php index fb83d984dd90ba3480dc6bfe5b872a5d36b95dd1..a34872b4f2283abbddab88ca18be3af0758dde56 100644 --- a/typo3/sysext/frontend/Classes/Controller/TypoScriptFrontendController.php +++ b/typo3/sysext/frontend/Classes/Controller/TypoScriptFrontendController.php @@ -2133,7 +2133,7 @@ class TypoScriptFrontendController implements LoggerAwareInterface $GET['id'] = $this->id; $this->cHash_array = $this->cacheHash->getRelevantParameters(GeneralUtility::implodeArrayForUrl('', $GET)); $cHash_calc = $this->cacheHash->calculateCacheHash($this->cHash_array); - if ($cHash_calc != $this->cHash) { + if (!hash_equals($cHash_calc, $this->cHash)) { if ($GLOBALS['TYPO3_CONF_VARS']['FE']['pageNotFoundOnCHashError']) { $this->pageNotFoundAndExit('Request parameters could not be validated (&cHash comparison failed)'); } else { diff --git a/typo3/sysext/saltedpasswords/Classes/Salt/Pbkdf2Salt.php b/typo3/sysext/saltedpasswords/Classes/Salt/Pbkdf2Salt.php index ab80faadb3422d156cbd5c491b25cfef4523a36f..04fd93bf8553dcf6e5a98d6143b77e9195c8663e 100644 --- a/typo3/sysext/saltedpasswords/Classes/Salt/Pbkdf2Salt.php +++ b/typo3/sysext/saltedpasswords/Classes/Salt/Pbkdf2Salt.php @@ -109,7 +109,7 @@ class Pbkdf2Salt extends AbstractComposedSalt */ public function checkPassword(string $plainPW, string $saltedHashPW): bool { - return $this->isValidSalt($saltedHashPW) && \hash_equals($this->getHashedPassword($plainPW, $saltedHashPW), $saltedHashPW); + return $this->isValidSalt($saltedHashPW) && hash_equals($this->getHashedPassword($plainPW, $saltedHashPW), $saltedHashPW); } /** diff --git a/typo3/sysext/saltedpasswords/Classes/Salt/PhpassSalt.php b/typo3/sysext/saltedpasswords/Classes/Salt/PhpassSalt.php index 9dcf0846cb18c82ac36f4e83c26d0ea694777b0f..f2553d68a308a90d032874ce1c06ec57f8c72369 100644 --- a/typo3/sysext/saltedpasswords/Classes/Salt/PhpassSalt.php +++ b/typo3/sysext/saltedpasswords/Classes/Salt/PhpassSalt.php @@ -126,7 +126,7 @@ class PhpassSalt extends AbstractComposedSalt public function checkPassword(string $plainPW, string $saltedHashPW): bool { $hash = $this->cryptPassword($plainPW, $saltedHashPW); - return $hash && \hash_equals($hash, $saltedHashPW); + return $hash && hash_equals($hash, $saltedHashPW); } /** diff --git a/typo3/sysext/saltedpasswords/Classes/SaltedPasswordService.php b/typo3/sysext/saltedpasswords/Classes/SaltedPasswordService.php index e8d1e49a316a1621ab07c110bd344c8134d9975d..4cc6fec4221fa0fc85784ebcac22d1c3e7737e68 100644 --- a/typo3/sysext/saltedpasswords/Classes/SaltedPasswordService.php +++ b/typo3/sysext/saltedpasswords/Classes/SaltedPasswordService.php @@ -137,13 +137,13 @@ class SaltedPasswordService extends AbstractAuthenticationService $this->authenticationFailed = true; } } elseif (preg_match('/[0-9abcdef]{32,32}/', $user['password'])) { - $validPasswd = \hash_equals(md5($password), (string)$user['password']); + $validPasswd = hash_equals(md5($password), (string)$user['password']); // Skip further authentication methods if (!$validPasswd) { $this->authenticationFailed = true; } } else { - $validPasswd = (string)$password !== '' && \hash_equals((string)$user['password'], (string)$password); + $validPasswd = (string)$password !== '' && hash_equals((string)$user['password'], (string)$password); } // Should we store the new format value in DB? if ($validPasswd && (int)$this->extConf['updatePasswd']) {