diff options
| author | historia <[not public]> | 2026-09-18 17:48:26 -0400 |
|---|---|---|
| committer | historia <[not public]> | 2026-09-18 17:48:26 -0400 |
| commit | 8fe9e3c3fef0049df82281a62afe35dda516dfe2 (patch) | |
| tree | dd269f2c0710f334e19f00a191260ebc46284a90 /internal/player/password.go | |
| parent | 194164a77eb4f2479b94c19e6f0e1278ab608781 (diff) | |
| download | thehouseoficarus-8fe9e3c3fef0049df82281a62afe35dda516dfe2.tar.gz | |
fix: close combat ghost, admin traversal, login throttle, journal double-pay, and quality/economy gaps
Diffstat (limited to 'internal/player/password.go')
| -rw-r--r-- | internal/player/password.go | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/internal/player/password.go b/internal/player/password.go index 5a43e1b..de5fe5f 100644 --- a/internal/player/password.go +++ b/internal/player/password.go @@ -120,7 +120,7 @@ func CheckPassword(password, stored string) bool { return false } hash := sha256.Sum256(append(salt, []byte(password)...)) - return legacy[2] == fmt.Sprintf("%x", hash) + return subtle.ConstantTimeCompare([]byte(legacy[2]), []byte(fmt.Sprintf("%x", hash))) == 1 default: return false } |