joomla/joomla-cms — pull request #4206 by dunglas (2014-09-02 06:58:12+00:00)
Title: Use hash_equals for constant-time string comparison

Use the `hash_equals` function (introduced in PHP 5.6) for timing attack safe string comparison when available.
Add in the DocBlock that length will leak (see php/php-src#792).