From 053868f5931d21e80f48a47b6078f452a920c013 Mon Sep 17 00:00:00 2001
From: bergquist <carl.bergquist@gmail.com>
Date: Mon, 18 Jan 2016 08:38:32 +0100
Subject: [PATCH] fix(login): fix vulnerbility for timing attacks

closes #3760
---
 pkg/login/auth.go | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkg/login/auth.go b/pkg/login/auth.go
index 38d87444e23..f2034476f81 100644
--- a/pkg/login/auth.go
+++ b/pkg/login/auth.go
@@ -3,6 +3,7 @@ package login
 import (
 	"errors"
 
+	"crypto/subtle"
 	"github.com/grafana/grafana/pkg/bus"
 	m "github.com/grafana/grafana/pkg/models"
 	"github.com/grafana/grafana/pkg/setting"
@@ -56,7 +57,7 @@ func loginUsingGrafanaDB(query *LoginUserQuery) error {
 	user := userQuery.Result
 
 	passwordHashed := util.EncodePassword(query.Password, user.Salt)
-	if passwordHashed != user.Password {
+	if subtle.ConstantTimeCompare([]byte(passwordHashed), []byte(user.Password)) != 1 {
 		return ErrInvalidCredentials
 	}