From ab06a888e216f5d93bbc87aa69bac140cc058641 Mon Sep 17 00:00:00 2001
From: Helmut Grohne <helmut@subdivi.de>
Date: Sun, 26 Mar 2017 14:43:38 +0200
Subject: use secrets.compare_digest when available

---
 wsgitools/digest.py | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/wsgitools/digest.py b/wsgitools/digest.py
index 4f21af0..846257a 100644
--- a/wsgitools/digest.py
+++ b/wsgitools/digest.py
@@ -18,11 +18,13 @@ import hashlib
 import time
 import os
 try:
-    from secrets import randbits
+    from secrets import randbits, compare_digest
 except ImportError:
     import random
     sysrand = random.SystemRandom()
     randbits = sysrand.getrandbits
+    def compare_digest(a, b):
+        return a == b
 
 from wsgitools.internal import bytes2str, str2bytes, textopen
 from wsgitools.authentication import AuthenticationRequired, \
@@ -185,7 +187,7 @@ class AbstractTokenGenerator(object):
         assert isinstance(username, str)
         assert isinstance(password, str)
         token = "%s:%s:%s" % (username, self.realm, password)
-        return md5hex(token) == self(username)
+        return compare_digest(md5hex(token), self(username))
 
 __all__.append("AuthTokenGenerator")
 class AuthTokenGenerator(AbstractTokenGenerator):
-- 
cgit v1.2.3