Merge pull request dokuwiki#4492 from dokuwiki/logintiming

add random delay on login dokuwiki#4491

Author: splitbrain

inc/auth.php

@@ -305,6 +305,7 @@ function auth_login($user, $pass, $sticky = false, $silent = false)
 
     if (!empty($user)) {
         //usual login
+        if (!empty($pass)) usleep(rand(0, 250)); // add a random delay to prevent timing attacks #4491
         if (!empty($pass) && $auth->checkPass($user, $pass)) {
             // make logininfo globally available
             $INPUT->server->set('REMOTE_USER', $user);

lib/plugins/authpdo/auth.php

@@ -123,7 +123,10 @@ public function checkPass($user, $pass)
     {
 
         $userdata = $this->selectUser($user);
-        if ($userdata == false) return false;
+        if ($userdata === false) {
+            auth_cryptPassword('dummy'); // run a crypt op to prevent timing attacks
+            return false;
+        }
 
         // password checking done in SQL?
         if ($this->checkConfig(['check-pass'])) {

lib/plugins/authplain/auth.php

@@ -68,7 +68,10 @@ public function __construct()
     public function checkPass($user, $pass)
     {
         $userinfo = $this->getUserData($user);
-        if ($userinfo === false) return false;
+        if ($userinfo === false) {
+            auth_cryptPassword('dummy'); // run a crypt op to prevent timing attacks
+            return false;
+        }
 
         return auth_verifyPassword($pass, $this->users[$user]['pass']);
     }