Merge branch 'develop' into 'feature/user-guide-cleanup'

2 files changed, 10 insertions, 2 deletions

diff --git a/system/libraries/Session/drivers/Session_cookie.php b/system/libraries/Session/drivers/Session_cookie.php
index 971dfeabe..c8dfad6c9 100644
--- a/system/libraries/Session/drivers/Session_cookie.php
+++ b/system/libraries/Session/drivers/Session_cookie.php
@@ -395,7 +395,15 @@ class CI_Session_cookie extends CI_Session_driver {
 		$hmac	 = substr($session, $len);
 		$session = substr($session, 0, $len);
 
-		if ($hmac !== hash_hmac('sha1', $session, $this->encryption_key))
+		// Time-attack-safe comparison
+		$hmac_check = hash_hmac('sha1', $session, $this->encryption_key);
+		$diff = 0;
+		for ($i = 0; $i < 40; $i++)
+		{
+			$diff |= ord($hmac[$i]) ^ ord($hmac_check[$i]);
+		}
+
+		if ($diff !== 0)
 		{
 			log_message('error', 'The session cookie data did not match what was expected.');
 			$this->sess_destroy();
diff --git a/system/libraries/Zip.php b/system/libraries/Zip.php
index b10b0bb0f..58f06455c 100644
--- a/system/libraries/Zip.php
+++ b/system/libraries/Zip.php
@@ -294,7 +294,7 @@ class CI_Zip {
 			{
 				$name = str_replace('\\', '/', $path);
 
-				if ($preserve_filepath === FALSE)
+				if ($archive_filepath === FALSE)
 				{
 					$name = preg_replace('|.*/(.+)|', '\\1', $name);
 				}