Use constant-time comparison for password reset tokens (#4698)

Author: vitek-rostislav

src/Model/Administrator/Administrator.php

@@ -676,7 +676,7 @@ public function getResetPasswordHash()
     #[Override]
     public function isResetPasswordHashValid(?string $hash): bool
     {
-        if ($hash === null || $this->resetPasswordHash !== $hash) {
+        if ($hash === null || $this->resetPasswordHash === null || !hash_equals($this->resetPasswordHash, $hash)) {
             return false;
         }
 

src/Model/Customer/User/CustomerUser.php

@@ -456,7 +456,7 @@ public function setResetPasswordHash($resetPasswordHash): void
     #[Override]
     public function isResetPasswordHashValid(?string $hash): bool
     {
-        if ($hash === null || $this->resetPasswordHash !== $hash) {
+        if ($hash === null || $this->resetPasswordHash === null || !hash_equals($this->resetPasswordHash, $hash)) {
             return false;
         }