Fix (security): don't accept empty reset keys for users with no password reset pending

Currently, it's possible to reset passwords for users that do not have any password reset by providing an empty key, which would match '' or NULL.

models/Authentication.php

@@ -37,6 +37,10 @@ class Authentication
 
 	public static function checkResetKey($id_user, $reset_key)
 	{
+		// Users without a pending reset have a blank key, which must never match.
+		if (!is_string($reset_key) || $reset_key === '')
+			return false;
+
 		$key = Registry::get('db')->queryValue('
 			SELECT reset_key
 			FROM users
@@ -45,7 +49,10 @@ class Authentication
 				'id' => $id_user,
 			]);
 
-		return $key == $reset_key;
+		if (!is_string($key) || $key === '')
+			return false;
+
+		return hash_equals($key, $reset_key);
 	}
 
 	/**