From 8fe9e3c3fef0049df82281a62afe35dda516dfe2 Mon Sep 17 00:00:00 2001
From: historia <[not public]>
Date: Fri, 18 Sep 2026 17:48:26 -0400
Subject: fix: close combat ghost, admin traversal, login throttle, journal
 double-pay, and quality/economy gaps

---
 internal/player/password.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'internal/player/password.go')

diff --git a/internal/player/password.go b/internal/player/password.go
index 5a43e1b..de5fe5f 100644
--- a/internal/player/password.go
+++ b/internal/player/password.go
@@ -120,7 +120,7 @@ func CheckPassword(password, stored string) bool {
 			return false
 		}
 		hash := sha256.Sum256(append(salt, []byte(password)...))
-		return legacy[2] == fmt.Sprintf("%x", hash)
+		return subtle.ConstantTimeCompare([]byte(legacy[2]), []byte(fmt.Sprintf("%x", hash))) == 1
 	default:
 		return false
 	}
-- 
cgit v1.2.3