This is an automated email from the ASF dual-hosted git repository. asf-gitbox-commits pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/allura.git
commit 2a6733f1fb8cf87df74cfa002ff59fcd4407f1ff Author: Dave Brondsema <[email protected]> AuthorDate: Sat May 16 11:16:00 2026 -0400 [#8607] safer pwd comparison --- Allura/allura/lib/plugin.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Allura/allura/lib/plugin.py b/Allura/allura/lib/plugin.py index cd8291ff8..bcd03109e 100644 --- a/Allura/allura/lib/plugin.py +++ b/Allura/allura/lib/plugin.py @@ -21,6 +21,7 @@ from __future__ import annotations import re import os +import hmac import logging import subprocess import string @@ -698,7 +699,7 @@ def _validate_password(self, user: M.User, password) -> bool: # legacy. 'allura_sha256' is a custom name for our old logic salt = str(user.password[6:6 + user.SALT_LEN]) check = self._encode_password_legacy_sha256(password, salt) - return check == user.password + return hmac.compare_digest(check, user.password) else: # https://passlib.readthedocs.io/en/stable/narr/context-tutorial.html#deprecation-hash-migration crypt = CryptContext(
