joomla/joomla-cms — pull request #3829 by sarciszewski (2014-06-25 19:29:43+00:00)
Title: No timing attacks for you!

https://www.isecpartners.com/blog/2011/february/double-hmac-verification.aspx

Let's not compare hashes in a way that creates cryptographic side-channels.