[5.3] Use time safe compare method in phpass library (#45477)

Author: SniperSister

administrator/manifests/libraries/phpass.xml

@@ -8,7 +8,7 @@
 	<authorEmail>[email protected]</authorEmail>
 	<authorUrl>https://www.openwall.com/phpass/</authorUrl>
 	<license>PD / GWC</license>
-	<version>0.3</version>
+	<version>0.5.1</version>
 	<packagerurl>https://www.openwall.com/phpass/</packagerurl>
 
 	<files folder="phpass">

libraries/phpass/PasswordHash.php

@@ -2,7 +2,7 @@
 #
 # Portable PHP password hashing framework.
 #
-# Version 0.5 / genuine.
+# Version 0.5.1 / Joomla Project.
 #
 # Written by Solar Designer <solar at openwall.com> in 2004-2006 and placed in
 # the public domain.  Revised in subsequent years, still public domain.
@@ -216,11 +216,7 @@ function CheckPassword($password, $stored_hash)
 		if ($hash[0] === '*')
 			$hash = crypt($password, $stored_hash);
 
-		# This is not constant-time.  In order to keep the code simple,
-		# for timing safety we currently rely on the salts being
-		# unpredictable, which they are at least in the non-fallback
-		# cases (that is, when we use /dev/urandom and bcrypt).
-		return $hash === $stored_hash;
+		return hash_equals($hash, $stored_hash);
 	}
 }