nhyatt/bitwarden
1
0
Fork 0
mirror of https://github.com/bitwarden/server.git synced 2025-07-05 10:02:47 -05:00
Code Activity

use fixed-time comparison of secrets (#1698)

Browse Source
This commit is contained in:
Kyle Spearrin
2021-11-08 15:55:42 -05:00
committed by GitHub
parent c07794e907
commit 7cc7b84eaf
8 changed files with 18 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
src/Billing/Controllers/PayPalController.cs
View File

@ -3,6 +3,7 @@ using Bit.Core.Enums;
using Bit.Core.Models.Table;
using Bit.Core.Repositories;
using Bit.Core.Services;
using Bit.Core.Utilities;
using Microsoft.AspNetCore.Mvc;
using Microsoft.Extensions.Logging;
using Microsoft.Extensions.Options;
@ -56,7 +57,7 @@ namespace Bit.Billing.Controllers
var key = HttpContext.Request.Query.ContainsKey("key") ?
HttpContext.Request.Query["key"].ToString() : null;
if (key != _billingSettings.PayPal.WebhookKey)
if (!CoreHelpers.FixedTimeEquals(key, _billingSettings.PayPal.WebhookKey))
{
_logger.LogWarning("PayPal webhook key is incorrect or does not exist.");
return new BadRequestResult();