diff --git a/flask_bcrypt.py b/flask_bcrypt.py index 103a011..a4f6a0e 100644 --- a/flask_bcrypt.py +++ b/flask_bcrypt.py @@ -16,7 +16,7 @@ __copyright__ = '(c) 2011 by Max Countryman, (c) 2021 by Suren Khorenyan' __all__ = ['Bcrypt', 'check_password_hash', 'generate_password_hash'] -from werkzeug.security import safe_str_cmp +import hmac try: import bcrypt @@ -230,4 +230,4 @@ def check_password_hash(self, pw_hash, password): password = hashlib.sha256(password).hexdigest() password = self._unicode_to_bytes(password) - return safe_str_cmp(bcrypt.hashpw(password, pw_hash), pw_hash) + return hmac.compare_digest(bcrypt.hashpw(password, pw_hash), pw_hash)