Deleted pun_hash_equals() function

include/functions.php

@@ -35,7 +35,7 @@ function check_cookie(&$pun_user)
 	if (isset($cookie) && $cookie['user_id'] > 1 && $cookie['expiration_time'] > $now)
 	{
 		// If the cookie has been tampered with
-		$is_authorized = pun_hash_equals(forum_hmac($cookie['user_id'].'|'.$cookie['expiration_time'], $cookie_seed.'_cookie_hash'), $cookie['cookie_hash']);
+		$is_authorized = hash_equals(forum_hmac($cookie['user_id'].'|'.$cookie['expiration_time'], $cookie_seed.'_cookie_hash'), $cookie['cookie_hash']);
 		if (!$is_authorized)
 		{
 			$expire = $now + 31536000; // The cookie expires after a year
@@ -51,7 +51,7 @@ function check_cookie(&$pun_user)
 		$pun_user = $db->fetch_assoc($result);
 
 		// If user authorisation failed
-		$is_authorized = pun_hash_equals(forum_hmac($pun_user['password'], $cookie_seed.'_password_hash'), $cookie['password_hash']);
+		$is_authorized = hash_equals(forum_hmac($pun_user['password'], $cookie_seed.'_password_hash'), $cookie['password_hash']);
 		if (!isset($pun_user['id']) || !$is_authorized)
 		{
 			$expire = $now + 31536000; // The cookie expires after a year
@@ -172,8 +172,8 @@ function authenticate_user($user, $password, $password_is_hash = false)
 	$result = $db->query('SELECT u.*, g.*, o.logged, o.idle FROM '.$db->prefix.'users AS u INNER JOIN '.$db->prefix.'groups AS g ON g.g_id=u.group_id LEFT JOIN '.$db->prefix.'online AS o ON o.user_id=u.id WHERE '.(is_int($user) ? 'u.id='.intval($user) : 'u.username=\''.$db->escape($user).'\'')) or error('Unable to fetch user info', __FILE__, __LINE__, $db->error());
 	$pun_user = $db->fetch_assoc($result);
 
-	$is_password_authorized = pun_hash_equals($password, $pun_user['password']);
-	$is_hash_authorized = pun_hash_equals(pun_hash($password), $pun_user['password']);
+	$is_password_authorized = hash_equals($password, $pun_user['password']);
+	$is_hash_authorized = hash_equals(pun_hash($password), $pun_user['password']);
 
 	if (!isset($pun_user['id']) ||
 		($password_is_hash && !$is_password_authorized ||
@@ -1197,7 +1197,7 @@ function confirm_referrer($script, $error_msg = false, $use_ip = true)
 
 	$hash = $container->get('Request')->requestStr('csrf_hash', '');
 
-	if (empty($hash) || !pun_hash_equals(csrf_hash($script, $use_ip), $hash))
+	if (empty($hash) || !hash_equals(csrf_hash($script, $use_ip), $hash))
 		confirm_message($error_msg);
 }
 
@@ -1276,30 +1276,6 @@ function pun_hash($str)
 }
 
 
-//
-// Compare two strings in constant time
-// Inspired by WordPress
-//
-function pun_hash_equals($a, $b)
-{
-	if (function_exists('hash_equals'))
-		return hash_equals((string) $a, (string) $b);
-
-	$a_length = strlen($a);
-
-	if ($a_length !== strlen($b))
-		return false;
-
-	$result = 0;
-
-	// Do not attempt to "optimize" this.
-	for ($i = 0; $i < $a_length; $i++)
-		$result |= ord($a[$i]) ^ ord($b[$i]);
-
-	return $result === 0;
-}
-
-
 //
 // Compute a random hash used against CSRF attacks
 //
@@ -1321,7 +1297,7 @@ function check_csrf($token)
 {
 	global $lang_common;
 
-	$is_hash_authorized = pun_hash_equals($token, pun_csrf_token());
+	$is_hash_authorized = hash_equals($token, pun_csrf_token());
 
 	if (!isset($token) || !$is_hash_authorized)
 		message($lang_common['Bad csrf hash'], false, '404 Not Found');

include/pms_new/mdl/blocking.php

@@ -17,7 +17,7 @@ if ($uid < 2)
 	message($lang_common['Bad request'], false, '404 Not Found');
 
 $csrf_token = pmsn_csrf_token($uid);
-if (!pun_hash_equals($csrf_token, pmsn_get_var('csrf_token', '')))
+if (!hash_equals($csrf_token, pmsn_get_var('csrf_token', '')))
 	message($lang_common['Bad request'], false, '404 Not Found');
 
 $result = $db->query('SELECT id, group_id, username FROM '.$db->prefix.'users WHERE id='.$uid) or error('Unable to fetch user information', __FILE__, __LINE__, $db->error());

login.php

@@ -47,7 +47,7 @@ if ($request->isPost('form_sent') && $action === 'in')
 		// If there is a salt in the database we have upgraded from 1.3-legacy though haven't yet logged in
 		if (!empty($cur_user['salt']))
 		{
-			$is_salt_authorized = pun_hash_equals(sha1($cur_user['salt'].sha1($form_password)), $cur_user['password']);
+			$is_salt_authorized = hash_equals(sha1($cur_user['salt'].sha1($form_password)), $cur_user['password']);
 			if ($is_salt_authorized) // 1.3 used sha1(salt.sha1(pass))
 			{
 				$authorized = true;
@@ -58,7 +58,7 @@ if ($request->isPost('form_sent') && $action === 'in')
 		// If the length isn't 40 then the password isn't using sha1, so it must be md5 from 1.2
 		else if (strlen($cur_user['password']) != 40)
 		{
-			$is_md5_authorized = pun_hash_equals(md5($form_password.$salt1), $cur_user['password']); // Visman
+			$is_md5_authorized = hash_equals(md5($form_password.$salt1), $cur_user['password']); // Visman //????
 			if ($is_md5_authorized)
 			{
 				$authorized = true;
@@ -68,7 +68,7 @@ if ($request->isPost('form_sent') && $action === 'in')
 		}
 		// Otherwise we should have a normal sha1 password
 		else
-			$authorized = pun_hash_equals($cur_user['password'], $form_password_hash);
+			$authorized = hash_equals($cur_user['password'], $form_password_hash);
 	}
 
 	if (!$authorized)

pmsnew.php

@@ -35,7 +35,7 @@ $action = pmsn_get_var('action', '');
 if ($action == 'onoff')
 {
 	$csrf_token = pmsn_csrf_token('onoff');
-	if (!pun_hash_equals($csrf_token, pmsn_get_var('csrf_token', '')))
+	if (!hash_equals($csrf_token, pmsn_get_var('csrf_token', '')))
 		message($lang_common['Bad request'], false, '404 Not Found');
 
 	if ($pun_user['messages_enable'] == 0 || ($pun_user['messages_enable'] == 1 && $request->isPost('action2') && defined('PUN_PMS_NEW_CONFIRM')))
@@ -57,7 +57,7 @@ if ($action == 'onoff')
 else if ($action == 'email')
 {
 	$csrf_token = pmsn_csrf_token('email');
-	if (!pun_hash_equals($csrf_token, pmsn_get_var('csrf_token', '')))
+	if (!hash_equals($csrf_token, pmsn_get_var('csrf_token', '')))
 		message($lang_common['Bad request'], false, '404 Not Found');
 
 	if ($pun_user['messages_email'] == 1)