Merge branch '3.4' into 4.3

nicolas-grekas · nicolas-grekas · commit f4defb273b69 · 2019-11-12T14:07:20.000+01:00
* 3.4:
  [HttpFoundation] fix guessing mime-types of files with leading dash
  [Cache] forbid serializing AbstractAdapter and TagAwareAdapter instances
  Use constant time comparison in UriSigner
diff --git a/UriSigner.php b/UriSigner.php
@@ -79,7 +79,7 @@ public function check($uri)
         $hash = $params[$this->parameter];
         unset($params[$this->parameter]);
 
-        return $this->computeHash($this->buildUrl($url, $params)) === $hash;
+        return hash_equals($this->computeHash($this->buildUrl($url, $params)), $hash);
     }
 
     private function computeHash($uri)

Original file line number	Diff line number	Diff line change
`@@ -79,7 +79,7 @@ public function check($uri)`
`79`	`79`	`$hash = $params[$this->parameter];`
`80`	`80`	`unset($params[$this->parameter]);`
`81`	`81`
`82`		`- return $this->computeHash($this->buildUrl($url, $params)) === $hash;`
	`82`	`+ return hash_equals($this->computeHash($this->buildUrl($url, $params)), $hash);`
`83`	`83`	`}`
`84`	`84`
`85`	`85`	`private function computeHash($uri)`