System-End/hackatime
1
0
Fork 0
mirror of https://github.com/System-End/hackatime.git synced 2026-04-20 00:35:22 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

protect against timing attacks for admin keys (#766)

Browse source
This commit is contained in:
Echo 2026-01-03 10:45:11 -05:00 • committed by GitHub
parent 097e48471f
commit 6b56134df4
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
app/controllers/api/admin/application_controller.rb
View file

@ -9,7 +9,8 @@ module Api
def authenticate_admin_api_key!
authenticate_or_request_with_http_token do |token, options|
@admin_api_key = AdminApiKey.active.find_by(token: token)
admin_api_key = AdminApiKey.active.find { |key| ActiveSupport::SecurityUtils.secure_compare(key.token, token) }
@admin_api_key = admin_api_key
if @admin_api_key
@current_user = @admin_api_key.user