yiisoft/yii2 — pull request #4474 by tom-- (2014-07-27 16:11:44+00:00)
Title: 4469 compare string without shortcut

If `compareString()` is to be a public method (I'm not 100% sure about that) then it shouldn't leak information about the length of `$expected`. In this version it's timing depends only on the length of the `$actual` input. Param docs change to encourage users to put the external input in `$actual`.