admin.php: fix authentication bypass vulnerability

diff --git a/admin.php b/admin.php
index 25b16ed94e7b7241a5f2d3fad77fc80e9d988ea7..a0ae04b6d3bca449b9a5d11f62571ea9def1da8f 100644 (file)
--- a/admin.php
+++ b/admin.php
@@ -53,7 +53,7 @@ if (isset ($_POST['action']) && (strcmp ($_POST['action'], 'logout') == 0))
 /* Check classic admin password authentification. */
 if (isset ($_POST['admin_password']) && empty($cfg['admin_http_auth_user']))
 {
-    if (strcmp ($cfg['admin_password'], $_POST['admin_password']) == 0)
+    if ($cfg['admin_password'] === $_POST['admin_password'])
         $_SESSION['admin_auth'] = true;
     else
     {