Timing attack vulnerability in token comparison

@klausi provided the initial patch for Drupal 10, it needs review and backporting to Drupal 7. Please grant him issue credit.

drunken monkey → made their first commit to this issue’s fork.

drunken monkey → credited klausi → .

Thanks a lot for proposing this, good catch!
It seems almost impossible to exploit, but I’m the last one to argue against sticking to best practices, so of course such a check should use the correct function.

I created an MR with @klausi’s patch so it can be tested. I’m also posting a patch for Drupal 7 with the same fix.

Test bot was happy, too, so I merged the MR with @klausi’s fix.
No test coverage for D7, unfortunately, but seems innocent enough so I just merged that, too.

Thanks again, both of you!

Automatically closed - issue fixed for 2 weeks with no activity.