From 4cfb3f27f6a2697d0f54aa8def741c891b94d315 Mon Sep 17 00:00:00 2001
From: printempw <h@prinzeugen.net>
Date: Wed, 18 Jan 2017 12:59:52 +0800
Subject: [PATCH] use hash_equals() to compare password hash

---
 app/Models/User.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/Models/User.php b/app/Models/User.php
index afe9558c..d6299067 100644
--- a/app/Models/User.php
+++ b/app/Models/User.php
@@ -80,7 +80,7 @@ class User extends Model
     {
         // compare directly if any responses is returned by event dispatcher
         if ($result = static::getEncryptedPwdFromEvent($rawPasswd, $this)) {
-            return ($result == $this->password);
+            return hash_equals($this->password, $result);
         }
 
         return app('cipher')->verify($rawPasswd, $this->password, config('secure.salt'));