Use TimingSafeCompare() to compare passwords and password hashes (non-hmac only)

[user/henk/code/inspircd.git] / src / command_parse.cpp

diff --git a/src/command_parse.cpp b/src/command_parse.cpp
index eed549deb1e064593980d526685c347881df2c22..ed996e83ce3af2f73790daa6c22ae42536fb819d 100644 (file)
--- a/src/command_parse.cpp
+++ b/src/command_parse.cpp
@@ -40,7 +40,7 @@ bool InspIRCd::PassCompare(Extensible* ex, const std::string& data, const std::s
        if (!hashtype.empty() && hashtype != "plaintext")
                return false;
 
-       return (data == input);
+       return TimingSafeCompare(data, input);
 }
 
 bool CommandParser::LoopCall(User* user, Command* handler, const std::vector<std::string>& parameters, unsigned int splithere, int extra, bool usemax)