[tryton-commits] [tryton] [default] Compare reset password using constant time fu...

[Cédric Krier]

details:   https://code.tryton.org/tryton/commit/99660f995c4a
branch:    default
user:      Cédric Krier <c...@b2ck.com>
date:      Fri Apr 10 11:29:50 2026 +0200
description:
        Compare reset password using constant time function
diffstat:

 modules/web_user/user.py    |  4 ++--
 trytond/trytond/res/user.py |  3 ++-
 2 files changed, 4 insertions(+), 3 deletions(-)

diffs (41 lines):

diff -r 7afb61869f11 -r 99660f995c4a modules/web_user/user.py
--- a/modules/web_user/user.py  Fri May 22 15:46:38 2026 -0700
+++ b/modules/web_user/user.py  Fri Apr 10 11:29:50 2026 +0200
@@ -5,7 +5,7 @@
 import random
 import time
 import urllib.parse
-from secrets import token_hex
+from secrets import compare_digest, token_hex
 
 from sql import Literal, Null
 from sql.conditionals import Coalesce
@@ -329,7 +329,7 @@
                 ])
         if users:
             user, = users
-            if user.reset_password_token == token:
+            if compare_digest(user.reset_password_token, token):
                 now = datetime.datetime.now()
                 expire = user.reset_password_token_expire
                 user.clear_reset_password_token()
diff -r 7afb61869f11 -r 99660f995c4a trytond/trytond/res/user.py
--- a/trytond/trytond/res/user.py       Fri May 22 15:46:38 2026 -0700
+++ b/trytond/trytond/res/user.py       Fri Apr 10 11:29:50 2026 +0200
@@ -11,6 +11,7 @@
 import string
 import time
 import uuid
+from secrets import compare_digest
 
 try:
     import secrets
@@ -749,7 +750,7 @@
                                     })
                 return user_id
         if user_id and password_reset:
-            if password_reset == parameters['password']:
+            if compare_digest(password_reset, parameters['password']):
                 return user_id
 
     @classmethod