Use StringUtils::equals on CSRF token and add unit tests

1 files changed, 4 insertions, 5 deletions

diff --git a/lib/private/appframework/http/request.php b/lib/private/appframework/http/request.php
index baf2f0c4745..6f108fedc6d 100644
--- a/lib/private/appframework/http/request.php
+++ b/lib/private/appframework/http/request.php
@@ -33,6 +33,7 @@ use OC\Security\TrustedDomainHelper;
 use OCP\IConfig;
 use OCP\IRequest;
 use OCP\Security\ISecureRandom;
+use OCP\Security\StringUtils;
 
 /**
  * Class for accessing variables in the request.
@@ -416,12 +417,10 @@ class Request implements \ArrayAccess, \Countable, IRequest {
 		}
 
 		// Check if the token is valid
-		if($token !== $this->items['requesttoken']) {
-			// Not valid
-			return false;
-		} else {
-			// Valid token
+		if(StringUtils::equals($token, $this->items['requesttoken'])) {
 			return true;
+		} else {
+			return false;
 		}
 	}