Use strict time-constant function to compare TCPDF-tag hashes.

tecnickcom · Dec 23, 2024 · d54b97c · d54b97c
1 parent 387e803
commit d54b97c
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 1 deletion.
diff --git a/CHANGELOG.TXT b/CHANGELOG.TXT
@@ -1,5 +1,6 @@
 6.8.0 (2024-12-23)
 	- Escape error message.
+	- Use strict time-constant function to compare TCPDF-tag hashes.
 
 6.7.8 (2024-12-13)
 	- Improve SVG detection by checking for (mandatory) namespace.

diff --git a/tcpdf.php b/tcpdf.php
@@ -17260,7 +17260,7 @@ protected function unserializeTCPDFtag($data) {
 		$hlen = intval(substr($data, 0, $hpos));
 		$hash = substr($data, $hpos + 1, $hlen);
 		$encoded = substr($data, $hpos + 2 + $hlen);
-		if ($hash != $this->hashTCPDFtag($encoded)) {
+		if (!hash_equals( $this->hashTCPDFtag($encoded), $hash)) {
 			$this->Error('Invalid parameters');
 		}
 		return json_decode(urldecode($encoded), true);