run passcrypt when user does not exist dokuwiki#4491

This will automatically use the configured password hashing method, thus
matching what existing users most likely have for their hash as well.

Author: splitbrain

lib/plugins/authpdo/auth.php

@@ -123,7 +123,10 @@ public function checkPass($user, $pass)
     {
 
         $userdata = $this->selectUser($user);
-        if ($userdata == false) return false;
+        if ($userdata === false) {
+            auth_cryptPassword('dummy'); // run a crypt op to prevent timing attacks
+            return false;
+        }
 
         // password checking done in SQL?
         if ($this->checkConfig(['check-pass'])) {

lib/plugins/authplain/auth.php

@@ -68,7 +68,10 @@ public function __construct()
     public function checkPass($user, $pass)
     {
         $userinfo = $this->getUserData($user);
-        if ($userinfo === false) return false;
+        if ($userinfo === false) {
+            auth_cryptPassword('dummy'); // run a crypt op to prevent timing attacks
+            return false;
+        }
 
         return auth_verifyPassword($pass, $this->users[$user]['pass']);
     }