Use hash_equals() for email confirmation, approval and denial token comparisons (#1406)

* Use hash_equals() for email confirmation, approval and denial token comparisons

* Return early when the email token has no second chunk to decrypt

Author: MILAN88888

includes/class-ur-email-approval.php

@@ -49,7 +49,7 @@ public static function approve_user_after_verification() {
 
 				$saved_token = get_user_meta( $user_id, 'ur_confirm_approval_token', true );
 
-			if ( $ur_approval_token_raw === $saved_token ) {
+			if ( hash_equals( (string) $saved_token, $ur_approval_token_raw ) ) {
 				$user_manager = new UR_Admin_User_Manager( $user_id );
 				$user_manager->save_status( UR_Admin_User_Manager::APPROVED, true );
 
@@ -94,7 +94,7 @@ public static function deny_user_after_verification() {
 
 			$saved_token = get_user_meta( $user_id, 'ur_confirm_denial_token', true );
 
-			if ( $ur_denial_token_raw === $saved_token ) {
+			if ( hash_equals( (string) $saved_token, $ur_denial_token_raw ) ) {
 				$user_manager = new UR_Admin_User_Manager( $user_id );
 				$user_manager->save_status( UR_Admin_User_Manager::DENIED, true );
 

includes/class-ur-email-confirmation.php

@@ -213,7 +213,14 @@ public function check_token_before_authenticate() {
 		if ( ! isset( $_GET['ur_token'] ) || empty( $_GET['ur_token'] ) ) {
 			return;
 		} else {
-			$ur_token     = str_split( sanitize_text_field( wp_unslash( $_GET['ur_token'] ) ), 50 );
+			$ur_token_raw = sanitize_text_field( wp_unslash( $_GET['ur_token'] ) );
+			$ur_token     = str_split( $ur_token_raw, 50 );
+
+			// A token of 50 characters or fewer has no second chunk, so there is nothing to decrypt.
+			if ( count( $ur_token ) < 2 ) {
+				return;
+			}
+
 			$token_string = $ur_token[1];
 
 			if ( 2 < count( $ur_token ) ) {
@@ -234,7 +241,7 @@ public function check_token_before_authenticate() {
 			// Check if the token matches the token value stored in db.
 			$login_option = ur_get_user_login_option( $user_id );
 
-			if ( $user_token === $_GET['ur_token'] && ( 'email_confirmation' === $login_option || 'admin_approval_after_email_confirmation' === $login_option ) ) {
+			if ( hash_equals( (string) $user_token, $ur_token_raw ) && ( 'email_confirmation' === $login_option || 'admin_approval_after_email_confirmation' === $login_option ) ) {
 				$token_expiration_duration = 24 * 60 * 60;
 				/**
 				 * Filter hook to modify the token expiration duration.