From 23a05663155788b186620d0c7a88dc2e297b0f36 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Eduardo=20D=C3=ADaz?= Date: Wed, 18 Oct 2023 23:52:30 +0200 Subject: [PATCH] Enhance security and signature validation in check method Replaced strict comparison (===) with hash_equals() for timing-attack-resistant signature validation in the check method. --- CHANGELOG.md | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index e93e075..cac1b89 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,17 @@ All Notable changes to `Redsys` will be documented in this file +## Version 1.4.5 (2023-09-26) + +### Added +- Tag 1.4.5 + +### Changed +- Method `check` updated in `Tpv.php` to enhance security and improve validation of signatures. The change involved replacing strict comparison (`===`) with `hash_equals()` for signature validation. + +### Fixed +- None + ## Version 1.4.4 (2023-08-07) ### Added @@ -11,7 +22,7 @@ All Notable changes to `Redsys` will be documented in this file - Added new test for setMethod ### Fixed - Nothing -- + ## Version 1.4.3 (2023-02-16) ### Added