Add empty validation in api_is_valid_secret_key

jmontoyaa · jmontoyaa · commit d467daefd4dc · 2021-04-21T09:28:46.000+02:00
diff --git a/main/inc/lib/api.lib.php b/main/inc/lib/api.lib.php
@@ -6838,7 +6838,11 @@ function api_is_in_group($groupIdParam = null, $courseCodeParam = null)
  */
 function api_is_valid_secret_key($original_key_secret, $security_key)
 {
-    return $original_key_secret == sha1($security_key);
+    if (empty($original_key_secret) || empty($security_key)) {
+        return false;
+    }
+
+    return $original_key_secret === sha1($security_key);
 }
 
 /**

Original file line number	Diff line number	Diff line change
`@@ -6838,7 +6838,11 @@ function api_is_in_group($groupIdParam = null, $courseCodeParam = null)`
`6838`	`6838`	`*/`
`6839`	`6839`	`function api_is_valid_secret_key($original_key_secret, $security_key)`
`6840`	`6840`	`{`
`6841`		`- return $original_key_secret == sha1($security_key);`
	`6841`	`+ if (empty($original_key_secret) \|\| empty($security_key)) {`
	`6842`	`+ return false;`
	`6843`	`+ }`
	`6844`	`+`
	`6845`	`+ return $original_key_secret === sha1($security_key);`
`6842`	`6846`	`}`
`6843`	`6847`
`6844`	`6848`	`/**`