Mirrors/filebrowser
1
0
Fork 0
mirror of https://github.com/filebrowser/filebrowser.git synced 2026-07-17 16:36:49 +00:00
Code Issues Projects Releases Wiki Activity

fix: use constant-time comparison for share access token

Browse source 
Compare the share token with subtle.ConstantTimeCompare instead of ==.
This commit is contained in:
Henrique Dias 2026-06-03 12:21:23 +02:00
parent cdd666fc95
commit 19514367ad
No known key found for this signature in database
1 changed files with 2 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
http/public.go
View file

@ -1,6 +1,7 @@
package fbhttp
import (
"crypto/subtle"
"errors"
"net/http"
"net/url"
@ -136,7 +137,7 @@ func authenticateShareRequest(r *http.Request, l *share.Link) (int, error) {
return 0, nil
}
if r.URL.Query().Get("token") == l.Token {
if subtle.ConstantTimeCompare([]byte(r.URL.Query().Get("token")), []byte(l.Token)) == 1 {
return 0, nil
}