Fix (security): don't accept empty reset keys for users with no password reset pending (#57)

Currently, it's possible to reset passwords for users that do not have any password reset by providing an empty key, which would match '' or NULL.

Reviewed-on: #57
Reviewed-by: Aaron van Geffen <aaron@aaronweb.net>
Co-authored-by: Yorick van Pelt <yorick@yorickvanpelt.nl>

models/Authentication.php

@@ -37,6 +37,10 @@ class Authentication
 
 	public static function checkResetKey($id_user, $reset_key)
 	{
+		// Users without a pending reset have a blank key, which must never match.
+		if (!is_string($reset_key) || $reset_key === '')
+			return false;
+
 		$key = Registry::get('db')->queryValue('
 			SELECT reset_key
 			FROM users
@@ -45,7 +49,10 @@ class Authentication
 				'id' => $id_user,
 			]);
 
-		return $key == $reset_key;
+		if (!is_string($key) || $key === '')
+			return false;
+
+		return hash_equals($key, $reset_key);
 	}
 
 	/**