joomla/joomla-cms — pull request #3828 by sarciszewski (2014-06-25 19:28:35+00:00)
Title: No timing attacks for you!

https://www.isecpartners.com/blog/2011/february/double-hmac-verification.aspx

Let's not compare hashes in a way that creates cryptographic side-channels.