diff --git a/src/applications/auth/controller/PhabricatorAuthController.php b/src/applications/auth/controller/PhabricatorAuthController.php
index ece2d01dc4..db1c8c6da4 100644
--- a/src/applications/auth/controller/PhabricatorAuthController.php
+++ b/src/applications/auth/controller/PhabricatorAuthController.php
@@ -1,305 +1,305 @@
 <?php
 
 abstract class PhabricatorAuthController extends PhabricatorController {
 
   public function buildStandardPageResponse($view, array $data) {
     $page = $this->buildStandardPageView();
 
     $page->setApplicationName(pht('Login'));
     $page->setBaseURI('/login/');
     $page->setTitle(idx($data, 'title'));
     $page->appendChild($view);
 
     $response = new AphrontWebpageResponse();
     return $response->setContent($page->render());
   }
 
   protected function renderErrorPage($title, array $messages) {
     $view = new PHUIInfoView();
     $view->setTitle($title);
     $view->setErrors($messages);
 
     return $this->buildApplicationPage(
       $view,
       array(
         'title' => $title,
       ));
 
   }
 
   /**
    * Returns true if this install is newly setup (i.e., there are no user
    * accounts yet). In this case, we enter a special mode to permit creation
    * of the first account form the web UI.
    */
   protected function isFirstTimeSetup() {
     // If there are any auth providers, this isn't first time setup, even if
     // we don't have accounts.
     if (PhabricatorAuthProvider::getAllEnabledProviders()) {
       return false;
     }
 
     // Otherwise, check if there are any user accounts. If not, we're in first
     // time setup.
     $any_users = id(new PhabricatorPeopleQuery())
       ->setViewer(PhabricatorUser::getOmnipotentUser())
       ->setLimit(1)
       ->execute();
 
     return !$any_users;
   }
 
 
   /**
    * Log a user into a web session and return an @{class:AphrontResponse} which
    * corresponds to continuing the login process.
    *
    * Normally, this is a redirect to the validation controller which makes sure
    * the user's cookies are set. However, event listeners can intercept this
    * event and do something else if they prefer.
    *
    * @param   PhabricatorUser   User to log the viewer in as.
    * @return  AphrontResponse   Response which continues the login process.
    */
   protected function loginUser(PhabricatorUser $user) {
 
     $response = $this->buildLoginValidateResponse($user);
     $session_type = PhabricatorAuthSession::TYPE_WEB;
 
     $event_type = PhabricatorEventType::TYPE_AUTH_WILLLOGINUSER;
     $event_data = array(
       'user'        => $user,
       'type'        => $session_type,
       'response'    => $response,
       'shouldLogin' => true,
     );
 
     $event = id(new PhabricatorEvent($event_type, $event_data))
       ->setUser($user);
     PhutilEventEngine::dispatchEvent($event);
 
     $should_login = $event->getValue('shouldLogin');
     if ($should_login) {
       $session_key = id(new PhabricatorAuthSessionEngine())
         ->establishSession($session_type, $user->getPHID(), $partial = true);
 
       // NOTE: We allow disabled users to login and roadblock them later, so
       // there's no check for users being disabled here.
 
       $request = $this->getRequest();
       $request->setCookie(
         PhabricatorCookies::COOKIE_USERNAME,
         $user->getUsername());
       $request->setCookie(
         PhabricatorCookies::COOKIE_SESSION,
         $session_key);
 
       $this->clearRegistrationCookies();
     }
 
     return $event->getValue('response');
   }
 
   protected function clearRegistrationCookies() {
     $request = $this->getRequest();
 
     // Clear the registration key.
     $request->clearCookie(PhabricatorCookies::COOKIE_REGISTRATION);
 
     // Clear the client ID / OAuth state key.
     $request->clearCookie(PhabricatorCookies::COOKIE_CLIENTID);
 
     // Clear the invite cookie.
     $request->clearCookie(PhabricatorCookies::COOKIE_INVITE);
   }
 
   private function buildLoginValidateResponse(PhabricatorUser $user) {
     $validate_uri = new PhutilURI($this->getApplicationURI('validate/'));
     $validate_uri->setQueryParam('expect', $user->getUsername());
 
     return id(new AphrontRedirectResponse())->setURI((string)$validate_uri);
   }
 
   protected function renderError($message) {
     return $this->renderErrorPage(
       pht('Authentication Error'),
       array(
         $message,
       ));
   }
 
   protected function loadAccountForRegistrationOrLinking($account_key) {
     $request = $this->getRequest();
     $viewer = $request->getUser();
 
     $account = null;
     $provider = null;
     $response = null;
 
     if (!$account_key) {
       $response = $this->renderError(
         pht('Request did not include account key.'));
       return array($account, $provider, $response);
     }
 
     // NOTE: We're using the omnipotent user because the actual user may not
     // be logged in yet, and because we want to tailor an error message to
     // distinguish between "not usable" and "does not exist". We do explicit
     // checks later on to make sure this account is valid for the intended
     // operation. This requires edit permission for completeness and consistency
     // but it won't actually be meaningfully checked because we're using the
     // ominpotent user.
 
     $account = id(new PhabricatorExternalAccountQuery())
       ->setViewer(PhabricatorUser::getOmnipotentUser())
       ->withAccountSecrets(array($account_key))
       ->needImages(true)
       ->requireCapabilities(
         array(
           PhabricatorPolicyCapability::CAN_VIEW,
           PhabricatorPolicyCapability::CAN_EDIT,
         ))
       ->executeOne();
 
     if (!$account) {
       $response = $this->renderError(pht('No valid linkable account.'));
       return array($account, $provider, $response);
     }
 
     if ($account->getUserPHID()) {
       if ($account->getUserPHID() != $viewer->getPHID()) {
         $response = $this->renderError(
           pht(
             'The account you are attempting to register or link is already '.
             'linked to another user.'));
       } else {
         $response = $this->renderError(
           pht(
             'The account you are attempting to link is already linked '.
             'to your account.'));
       }
       return array($account, $provider, $response);
     }
 
     $registration_key = $request->getCookie(
       PhabricatorCookies::COOKIE_REGISTRATION);
 
     // NOTE: This registration key check is not strictly necessary, because
     // we're only creating new accounts, not linking existing accounts. It
     // might be more hassle than it is worth, especially for email.
     //
     // The attack this prevents is getting to the registration screen, then
     // copy/pasting the URL and getting someone else to click it and complete
     // the process. They end up with an account bound to credentials you
     // control. This doesn't really let you do anything meaningful, though,
     // since you could have simply completed the process yourself.
 
     if (!$registration_key) {
       $response = $this->renderError(
         pht(
           'Your browser did not submit a registration key with the request. '.
           'You must use the same browser to begin and complete registration. '.
           'Check that cookies are enabled and try again.'));
       return array($account, $provider, $response);
     }
 
     // We store the digest of the key rather than the key itself to prevent a
     // theoretical attacker with read-only access to the database from
     // hijacking registration sessions.
 
     $actual = $account->getProperty('registrationKey');
     $expect = PhabricatorHash::digest($registration_key);
-    if ($actual !== $expect) {
+    if (!phutil_hashes_are_identical($actual, $expect)) {
       $response = $this->renderError(
         pht(
           'Your browser submitted a different registration key than the one '.
           'associated with this account. You may need to clear your cookies.'));
       return array($account, $provider, $response);
     }
 
     $other_account = id(new PhabricatorExternalAccount())->loadAllWhere(
       'accountType = %s AND accountDomain = %s AND accountID = %s
         AND id != %d',
       $account->getAccountType(),
       $account->getAccountDomain(),
       $account->getAccountID(),
       $account->getID());
 
     if ($other_account) {
       $response = $this->renderError(
         pht(
           'The account you are attempting to register with already belongs '.
           'to another user.'));
       return array($account, $provider, $response);
     }
 
     $provider = PhabricatorAuthProvider::getEnabledProviderByKey(
       $account->getProviderKey());
 
     if (!$provider) {
       $response = $this->renderError(
         pht(
           'The account you are attempting to register with uses a nonexistent '.
           'or disabled authentication provider (with key "%s"). An '.
           'administrator may have recently disabled this provider.',
           $account->getProviderKey()));
       return array($account, $provider, $response);
     }
 
     return array($account, $provider, null);
   }
 
   protected function loadInvite() {
     $invite_cookie = PhabricatorCookies::COOKIE_INVITE;
     $invite_code = $this->getRequest()->getCookie($invite_cookie);
     if (!$invite_code) {
       return null;
     }
 
     $engine = id(new PhabricatorAuthInviteEngine())
       ->setViewer($this->getViewer())
       ->setUserHasConfirmedVerify(true);
 
     try {
       return $engine->processInviteCode($invite_code);
     } catch (Exception $ex) {
       // If this fails for any reason, just drop the invite. In normal
       // circumstances, we gave them a detailed explanation of any error
       // before they jumped into this workflow.
       return null;
     }
   }
 
   protected function renderInviteHeader(PhabricatorAuthInvite $invite) {
     $viewer = $this->getViewer();
 
     $invite_author = id(new PhabricatorPeopleQuery())
       ->setViewer($viewer)
       ->withPHIDs(array($invite->getAuthorPHID()))
       ->needProfileImage(true)
       ->executeOne();
 
     // If we can't load the author for some reason, just drop this message.
     // We lose the value of contextualizing things without author details.
     if (!$invite_author) {
       return null;
     }
 
     $invite_item = id(new PHUIObjectItemView())
       ->setHeader(pht('Welcome to Phabricator!'))
       ->setImageURI($invite_author->getProfileImageURI())
       ->addAttribute(
         pht(
           '%s has invited you to join Phabricator.',
           $invite_author->getFullName()));
 
     $invite_list = id(new PHUIObjectItemListView())
       ->addItem($invite_item)
       ->setFlush(true);
 
     return id(new PHUIBoxView())
       ->addMargin(PHUI::MARGIN_LARGE)
       ->appendChild($invite_list);
   }
 
 }
diff --git a/src/applications/auth/controller/PhabricatorAuthTerminateSessionController.php b/src/applications/auth/controller/PhabricatorAuthTerminateSessionController.php
index ae8179a798..43ac80bb70 100644
--- a/src/applications/auth/controller/PhabricatorAuthTerminateSessionController.php
+++ b/src/applications/auth/controller/PhabricatorAuthTerminateSessionController.php
@@ -1,74 +1,77 @@
 <?php
 
 final class PhabricatorAuthTerminateSessionController
   extends PhabricatorAuthController {
 
   public function handleRequest(AphrontRequest $request) {
     $viewer = $this->getViewer();
     $id = $request->getURIData('id');
 
     $is_all = ($id === 'all');
 
     $query = id(new PhabricatorAuthSessionQuery())
       ->setViewer($viewer)
       ->withIdentityPHIDs(array($viewer->getPHID()));
     if (!$is_all) {
       $query->withIDs(array($id));
     }
 
     $current_key = PhabricatorHash::digest(
       $request->getCookie(PhabricatorCookies::COOKIE_SESSION));
 
     $sessions = $query->execute();
     foreach ($sessions as $key => $session) {
-      if ($session->getSessionKey() == $current_key) {
+      $is_current = phutil_hashes_are_identical(
+        $session->getSessionKey(),
+        $current_key);
+      if ($is_current) {
         // Don't terminate the current login session.
         unset($sessions[$key]);
       }
     }
 
     $panel_uri = '/settings/panel/sessions/';
 
     if (!$sessions) {
       return $this->newDialog()
         ->setTitle(pht('No Matching Sessions'))
         ->appendParagraph(
           pht('There are no matching sessions to terminate.'))
         ->appendParagraph(
           pht(
             '(You can not terminate your current login session. To '.
             'terminate it, log out.)'))
         ->addCancelButton($panel_uri);
     }
 
     if ($request->isDialogFormPost()) {
       foreach ($sessions as $session) {
         $session->delete();
       }
       return id(new AphrontRedirectResponse())->setURI($panel_uri);
     }
 
     if ($is_all) {
       $title = pht('Terminate Sessions?');
       $short = pht('Terminate Sessions');
       $body = pht(
         'Really terminate all sessions? (Your current login session will '.
         'not be terminated.)');
     } else {
       $title = pht('Terminate Session?');
       $short = pht('Terminate Session');
       $body = pht(
         'Really terminate session %s?',
         phutil_tag('strong', array(), substr($session->getSessionKey(), 0, 6)));
     }
 
     return $this->newDialog()
       ->setTitle($title)
       ->setShortTitle($short)
       ->appendParagraph($body)
       ->addSubmitButton(pht('Terminate'))
       ->addCancelButton($panel_uri);
   }
 
 
 }
diff --git a/src/applications/auth/engine/PhabricatorAuthSessionEngine.php b/src/applications/auth/engine/PhabricatorAuthSessionEngine.php
index cec965f6b5..77ba80bccb 100644
--- a/src/applications/auth/engine/PhabricatorAuthSessionEngine.php
+++ b/src/applications/auth/engine/PhabricatorAuthSessionEngine.php
@@ -1,723 +1,726 @@
 <?php
 
 /**
  *
  * @task use      Using Sessions
  * @task new      Creating Sessions
  * @task hisec    High Security
  * @task partial  Partial Sessions
  * @task onetime  One Time Login URIs
  */
 final class PhabricatorAuthSessionEngine extends Phobject {
 
   /**
    * Session issued to normal users after they login through a standard channel.
    * Associates the client with a standard user identity.
    */
   const KIND_USER      = 'U';
 
 
   /**
    * Session issued to users who login with some sort of credentials but do not
    * have full accounts. These are sometimes called "grey users".
    *
    * TODO: We do not currently issue these sessions, see T4310.
    */
   const KIND_EXTERNAL  = 'X';
 
 
   /**
    * Session issued to logged-out users which has no real identity information.
    * Its purpose is to protect logged-out users from CSRF.
    */
   const KIND_ANONYMOUS = 'A';
 
 
   /**
    * Session kind isn't known.
    */
   const KIND_UNKNOWN   = '?';
 
 
   /**
    * Temporary tokens for one time logins.
    */
   const ONETIME_TEMPORARY_TOKEN_TYPE = 'login:onetime';
 
 
   /**
    * Temporary tokens for password recovery after one time login.
    */
   const PASSWORD_TEMPORARY_TOKEN_TYPE = 'login:password';
 
   const ONETIME_RECOVER = 'recover';
   const ONETIME_RESET = 'reset';
   const ONETIME_WELCOME = 'welcome';
   const ONETIME_USERNAME = 'rename';
 
 
   /**
    * Get the session kind (e.g., anonymous, user, external account) from a
    * session token. Returns a `KIND_` constant.
    *
    * @param   string  Session token.
    * @return  const   Session kind constant.
    */
   public static function getSessionKindFromToken($session_token) {
     if (strpos($session_token, '/') === false) {
       // Old-style session, these are all user sessions.
       return self::KIND_USER;
     }
 
     list($kind, $key) = explode('/', $session_token, 2);
 
     switch ($kind) {
       case self::KIND_ANONYMOUS:
       case self::KIND_USER:
       case self::KIND_EXTERNAL:
         return $kind;
       default:
         return self::KIND_UNKNOWN;
     }
   }
 
 
   /**
    * Load the user identity associated with a session of a given type,
    * identified by token.
    *
    * When the user presents a session token to an API, this method verifies
    * it is of the correct type and loads the corresponding identity if the
    * session exists and is valid.
    *
    * NOTE: `$session_type` is the type of session that is required by the
    * loading context. This prevents use of a Conduit sesssion as a Web
    * session, for example.
    *
    * @param const The type of session to load.
    * @param string The session token.
    * @return PhabricatorUser|null
    * @task use
    */
   public function loadUserForSession($session_type, $session_token) {
     $session_kind = self::getSessionKindFromToken($session_token);
     switch ($session_kind) {
       case self::KIND_ANONYMOUS:
         // Don't bother trying to load a user for an anonymous session, since
         // neither the session nor the user exist.
         return null;
       case self::KIND_UNKNOWN:
         // If we don't know what kind of session this is, don't go looking for
         // it.
         return null;
       case self::KIND_USER:
         break;
       case self::KIND_EXTERNAL:
         // TODO: Implement these (T4310).
         return null;
     }
 
     $session_table = new PhabricatorAuthSession();
     $user_table = new PhabricatorUser();
     $conn_r = $session_table->establishConnection('r');
     $session_key = PhabricatorHash::digest($session_token);
 
     // NOTE: We're being clever here because this happens on every page load,
     // and by joining we can save a query. This might be getting too clever
     // for its own good, though...
 
     $info = queryfx_one(
       $conn_r,
       'SELECT
           s.id AS s_id,
           s.sessionExpires AS s_sessionExpires,
           s.sessionStart AS s_sessionStart,
           s.highSecurityUntil AS s_highSecurityUntil,
           s.isPartial AS s_isPartial,
           s.signedLegalpadDocuments as s_signedLegalpadDocuments,
           u.*
         FROM %T u JOIN %T s ON u.phid = s.userPHID
         AND s.type = %s AND s.sessionKey = %s',
       $user_table->getTableName(),
       $session_table->getTableName(),
       $session_type,
       $session_key);
 
     if (!$info) {
       return null;
     }
 
     $session_dict = array(
       'userPHID' => $info['phid'],
       'sessionKey' => $session_key,
       'type' => $session_type,
     );
     foreach ($info as $key => $value) {
       if (strncmp($key, 's_', 2) === 0) {
         unset($info[$key]);
         $session_dict[substr($key, 2)] = $value;
       }
     }
 
     $user = $user_table->loadFromArray($info);
     switch ($session_type) {
       case PhabricatorAuthSession::TYPE_WEB:
         // Explicitly prevent bots and mailing lists from establishing web
         // sessions. It's normally impossible to attach authentication to these
         // accounts, and likewise impossible to generate sessions, but it's
         // technically possible that a session could exist in the database. If
         // one does somehow, refuse to load it.
         if (!$user->canEstablishWebSessions()) {
           return null;
         }
         break;
     }
 
     $session = id(new PhabricatorAuthSession())->loadFromArray($session_dict);
 
     $ttl = PhabricatorAuthSession::getSessionTypeTTL($session_type);
 
     // If more than 20% of the time on this session has been used, refresh the
     // TTL back up to the full duration. The idea here is that sessions are
     // good forever if used regularly, but get GC'd when they fall out of use.
 
     // NOTE: If we begin rotating session keys when extending sessions, the
     // CSRF code needs to be updated so CSRF tokens survive session rotation.
 
     if (time() + (0.80 * $ttl) > $session->getSessionExpires()) {
       $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
         $conn_w = $session_table->establishConnection('w');
         queryfx(
           $conn_w,
           'UPDATE %T SET sessionExpires = UNIX_TIMESTAMP() + %d WHERE id = %d',
           $session->getTableName(),
           $ttl,
           $session->getID());
       unset($unguarded);
     }
 
     $user->attachSession($session);
     return $user;
   }
 
 
   /**
    * Issue a new session key for a given identity. Phabricator supports
    * different types of sessions (like "web" and "conduit") and each session
    * type may have multiple concurrent sessions (this allows a user to be
    * logged in on multiple browsers at the same time, for instance).
    *
    * Note that this method is transport-agnostic and does not set cookies or
    * issue other types of tokens, it ONLY generates a new session key.
    *
    * You can configure the maximum number of concurrent sessions for various
    * session types in the Phabricator configuration.
    *
    * @param   const     Session type constant (see
    *                    @{class:PhabricatorAuthSession}).
    * @param   phid|null Identity to establish a session for, usually a user
    *                    PHID. With `null`, generates an anonymous session.
    * @param   bool      True to issue a partial session.
    * @return  string    Newly generated session key.
    */
   public function establishSession($session_type, $identity_phid, $partial) {
     // Consume entropy to generate a new session key, forestalling the eventual
     // heat death of the universe.
     $session_key = Filesystem::readRandomCharacters(40);
 
     if ($identity_phid === null) {
       return self::KIND_ANONYMOUS.'/'.$session_key;
     }
 
     $session_table = new PhabricatorAuthSession();
     $conn_w = $session_table->establishConnection('w');
 
     // This has a side effect of validating the session type.
     $session_ttl = PhabricatorAuthSession::getSessionTypeTTL($session_type);
 
     $digest_key = PhabricatorHash::digest($session_key);
 
     // Logging-in users don't have CSRF stuff yet, so we have to unguard this
     // write.
     $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
       id(new PhabricatorAuthSession())
         ->setUserPHID($identity_phid)
         ->setType($session_type)
         ->setSessionKey($digest_key)
         ->setSessionStart(time())
         ->setSessionExpires(time() + $session_ttl)
         ->setIsPartial($partial ? 1 : 0)
         ->setSignedLegalpadDocuments(0)
         ->save();
 
       $log = PhabricatorUserLog::initializeNewLog(
         null,
         $identity_phid,
         ($partial
           ? PhabricatorUserLog::ACTION_LOGIN_PARTIAL
           : PhabricatorUserLog::ACTION_LOGIN));
 
       $log->setDetails(
         array(
           'session_type' => $session_type,
         ));
       $log->setSession($digest_key);
       $log->save();
     unset($unguarded);
 
     return $session_key;
   }
 
 
   /**
    * Terminate all of a user's login sessions.
    *
    * This is used when users change passwords, linked accounts, or add
    * multifactor authentication.
    *
    * @param PhabricatorUser User whose sessions should be terminated.
    * @param string|null Optionally, one session to keep. Normally, the current
    *   login session.
    *
    * @return void
    */
   public function terminateLoginSessions(
     PhabricatorUser $user,
     $except_session = null) {
 
     $sessions = id(new PhabricatorAuthSessionQuery())
       ->setViewer($user)
       ->withIdentityPHIDs(array($user->getPHID()))
       ->execute();
 
     if ($except_session !== null) {
       $except_session = PhabricatorHash::digest($except_session);
     }
 
     foreach ($sessions as $key => $session) {
       if ($except_session !== null) {
-        if ($except_session == $session->getSessionKey()) {
+        $is_except = phutil_hashes_are_identical(
+          $session->getSessionKey(),
+          $except_session);
+        if ($is_except) {
           continue;
         }
       }
 
       $session->delete();
     }
   }
 
 
 /* -(  High Security  )------------------------------------------------------ */
 
 
   /**
    * Require high security, or prompt the user to enter high security.
    *
    * If the user's session is in high security, this method will return a
    * token. Otherwise, it will throw an exception which will eventually
    * be converted into a multi-factor authentication workflow.
    *
    * @param PhabricatorUser User whose session needs to be in high security.
    * @param AphrontReqeust  Current request.
    * @param string          URI to return the user to if they cancel.
    * @param bool            True to jump partial sessions directly into high
    *                        security instead of just upgrading them to full
    *                        sessions.
    * @return PhabricatorAuthHighSecurityToken Security token.
    * @task hisec
    */
   public function requireHighSecuritySession(
     PhabricatorUser $viewer,
     AphrontRequest $request,
     $cancel_uri,
     $jump_into_hisec = false) {
 
     if (!$viewer->hasSession()) {
       throw new Exception(
         pht('Requiring a high-security session from a user with no session!'));
     }
 
     $session = $viewer->getSession();
 
     // Check if the session is already in high security mode.
     $token = $this->issueHighSecurityToken($session);
     if ($token) {
       return $token;
     }
 
     // Load the multi-factor auth sources attached to this account.
     $factors = id(new PhabricatorAuthFactorConfig())->loadAllWhere(
       'userPHID = %s',
       $viewer->getPHID());
 
     // If the account has no associated multi-factor auth, just issue a token
     // without putting the session into high security mode. This is generally
     // easier for users. A minor but desirable side effect is that when a user
     // adds an auth factor, existing sessions won't get a free pass into hisec,
     // since they never actually got marked as hisec.
     if (!$factors) {
       return $this->issueHighSecurityToken($session, true);
     }
 
     // Check for a rate limit without awarding points, so the user doesn't
     // get partway through the workflow only to get blocked.
     PhabricatorSystemActionEngine::willTakeAction(
       array($viewer->getPHID()),
       new PhabricatorAuthTryFactorAction(),
       0);
 
     $validation_results = array();
     if ($request->isHTTPPost()) {
       $request->validateCSRF();
       if ($request->getExists(AphrontRequest::TYPE_HISEC)) {
 
         // Limit factor verification rates to prevent brute force attacks.
         PhabricatorSystemActionEngine::willTakeAction(
           array($viewer->getPHID()),
           new PhabricatorAuthTryFactorAction(),
           1);
 
         $ok = true;
         foreach ($factors as $factor) {
           $id = $factor->getID();
           $impl = $factor->requireImplementation();
 
           $validation_results[$id] = $impl->processValidateFactorForm(
             $factor,
             $viewer,
             $request);
 
           if (!$impl->isFactorValid($factor, $validation_results[$id])) {
             $ok = false;
           }
         }
 
         if ($ok) {
           // Give the user a credit back for a successful factor verification.
           PhabricatorSystemActionEngine::willTakeAction(
             array($viewer->getPHID()),
             new PhabricatorAuthTryFactorAction(),
             -1);
 
           if ($session->getIsPartial() && !$jump_into_hisec) {
             // If we have a partial session and are not jumping directly into
             // hisec, just issue a token without putting it in high security
             // mode.
             return $this->issueHighSecurityToken($session, true);
           }
 
           $until = time() + phutil_units('15 minutes in seconds');
           $session->setHighSecurityUntil($until);
 
           queryfx(
             $session->establishConnection('w'),
             'UPDATE %T SET highSecurityUntil = %d WHERE id = %d',
             $session->getTableName(),
             $until,
             $session->getID());
 
           $log = PhabricatorUserLog::initializeNewLog(
             $viewer,
             $viewer->getPHID(),
             PhabricatorUserLog::ACTION_ENTER_HISEC);
           $log->save();
         } else {
           $log = PhabricatorUserLog::initializeNewLog(
             $viewer,
             $viewer->getPHID(),
             PhabricatorUserLog::ACTION_FAIL_HISEC);
           $log->save();
         }
       }
     }
 
     $token = $this->issueHighSecurityToken($session);
     if ($token) {
       return $token;
     }
 
     throw id(new PhabricatorAuthHighSecurityRequiredException())
       ->setCancelURI($cancel_uri)
       ->setFactors($factors)
       ->setFactorValidationResults($validation_results);
   }
 
 
   /**
    * Issue a high security token for a session, if authorized.
    *
    * @param PhabricatorAuthSession Session to issue a token for.
    * @param bool Force token issue.
    * @return PhabricatorAuthHighSecurityToken|null Token, if authorized.
    * @task hisec
    */
   private function issueHighSecurityToken(
     PhabricatorAuthSession $session,
     $force = false) {
 
     $until = $session->getHighSecurityUntil();
     if ($until > time() || $force) {
       return new PhabricatorAuthHighSecurityToken();
     }
 
     return null;
   }
 
 
   /**
    * Render a form for providing relevant multi-factor credentials.
    *
    * @param PhabricatorUser Viewing user.
    * @param AphrontRequest Current request.
    * @return AphrontFormView Renderable form.
    * @task hisec
    */
   public function renderHighSecurityForm(
     array $factors,
     array $validation_results,
     PhabricatorUser $viewer,
     AphrontRequest $request) {
 
     $form = id(new AphrontFormView())
       ->setUser($viewer)
       ->appendRemarkupInstructions('');
 
     foreach ($factors as $factor) {
       $factor->requireImplementation()->renderValidateFactorForm(
         $factor,
         $form,
         $viewer,
         idx($validation_results, $factor->getID()));
     }
 
     $form->appendRemarkupInstructions('');
 
     return $form;
   }
 
 
   /**
    * Strip the high security flag from a session.
    *
    * Kicks a session out of high security and logs the exit.
    *
    * @param PhabricatorUser Acting user.
    * @param PhabricatorAuthSession Session to return to normal security.
    * @return void
    * @task hisec
    */
   public function exitHighSecurity(
     PhabricatorUser $viewer,
     PhabricatorAuthSession $session) {
 
     if (!$session->getHighSecurityUntil()) {
       return;
     }
 
     queryfx(
       $session->establishConnection('w'),
       'UPDATE %T SET highSecurityUntil = NULL WHERE id = %d',
       $session->getTableName(),
       $session->getID());
 
     $log = PhabricatorUserLog::initializeNewLog(
       $viewer,
       $viewer->getPHID(),
       PhabricatorUserLog::ACTION_EXIT_HISEC);
     $log->save();
   }
 
 
 /* -(  Partial Sessions  )--------------------------------------------------- */
 
 
   /**
    * Upgrade a partial session to a full session.
    *
    * @param PhabricatorAuthSession Session to upgrade.
    * @return void
    * @task partial
    */
   public function upgradePartialSession(PhabricatorUser $viewer) {
 
     if (!$viewer->hasSession()) {
       throw new Exception(
         pht('Upgrading partial session of user with no session!'));
     }
 
     $session = $viewer->getSession();
 
     if (!$session->getIsPartial()) {
       throw new Exception(pht('Session is not partial!'));
     }
 
     $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
       $session->setIsPartial(0);
 
       queryfx(
         $session->establishConnection('w'),
         'UPDATE %T SET isPartial = %d WHERE id = %d',
         $session->getTableName(),
         0,
         $session->getID());
 
       $log = PhabricatorUserLog::initializeNewLog(
         $viewer,
         $viewer->getPHID(),
         PhabricatorUserLog::ACTION_LOGIN_FULL);
       $log->save();
     unset($unguarded);
   }
 
 
 /* -(  Legalpad Documents )-------------------------------------------------- */
 
 
   /**
    * Upgrade a session to have all legalpad documents signed.
    *
    * @param PhabricatorUser User whose session should upgrade.
    * @param array LegalpadDocument objects
    * @return void
    * @task partial
    */
   public function signLegalpadDocuments(PhabricatorUser $viewer, array $docs) {
 
     if (!$viewer->hasSession()) {
       throw new Exception(
         pht('Signing session legalpad documents of user with no session!'));
     }
 
     $session = $viewer->getSession();
 
     if ($session->getSignedLegalpadDocuments()) {
       throw new Exception(pht(
         'Session has already signed required legalpad documents!'));
     }
 
     $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
       $session->setSignedLegalpadDocuments(1);
 
       queryfx(
         $session->establishConnection('w'),
         'UPDATE %T SET signedLegalpadDocuments = %d WHERE id = %d',
         $session->getTableName(),
         1,
         $session->getID());
 
       if (!empty($docs)) {
         $log = PhabricatorUserLog::initializeNewLog(
           $viewer,
           $viewer->getPHID(),
           PhabricatorUserLog::ACTION_LOGIN_LEGALPAD);
         $log->save();
       }
     unset($unguarded);
   }
 
 
 /* -(  One Time Login URIs  )------------------------------------------------ */
 
 
   /**
    * Retrieve a temporary, one-time URI which can log in to an account.
    *
    * These URIs are used for password recovery and to regain access to accounts
    * which users have been locked out of.
    *
    * @param PhabricatorUser User to generate a URI for.
    * @param PhabricatorUserEmail Optionally, email to verify when
    *  link is used.
    * @param string Optional context string for the URI. This is purely cosmetic
    *  and used only to customize workflow and error messages.
    * @return string Login URI.
    * @task onetime
    */
   public function getOneTimeLoginURI(
     PhabricatorUser $user,
     PhabricatorUserEmail $email = null,
     $type = self::ONETIME_RESET) {
 
     $key = Filesystem::readRandomCharacters(32);
     $key_hash = $this->getOneTimeLoginKeyHash($user, $email, $key);
 
     $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
       id(new PhabricatorAuthTemporaryToken())
         ->setObjectPHID($user->getPHID())
         ->setTokenType(self::ONETIME_TEMPORARY_TOKEN_TYPE)
         ->setTokenExpires(time() + phutil_units('1 day in seconds'))
         ->setTokenCode($key_hash)
         ->save();
     unset($unguarded);
 
     $uri = '/login/once/'.$type.'/'.$user->getID().'/'.$key.'/';
     if ($email) {
       $uri = $uri.$email->getID().'/';
     }
 
     try {
       $uri = PhabricatorEnv::getProductionURI($uri);
     } catch (Exception $ex) {
       // If a user runs `bin/auth recover` before configuring the base URI,
       // just show the path. We don't have any way to figure out the domain.
       // See T4132.
     }
 
     return $uri;
   }
 
 
   /**
    * Load the temporary token associated with a given one-time login key.
    *
    * @param PhabricatorUser User to load the token for.
    * @param PhabricatorUserEmail Optionally, email to verify when
    *  link is used.
    * @param string Key user is presenting as a valid one-time login key.
    * @return PhabricatorAuthTemporaryToken|null Token, if one exists.
    * @task onetime
    */
   public function loadOneTimeLoginKey(
     PhabricatorUser $user,
     PhabricatorUserEmail $email = null,
     $key = null) {
 
     $key_hash = $this->getOneTimeLoginKeyHash($user, $email, $key);
 
     return id(new PhabricatorAuthTemporaryTokenQuery())
       ->setViewer($user)
       ->withObjectPHIDs(array($user->getPHID()))
       ->withTokenTypes(array(self::ONETIME_TEMPORARY_TOKEN_TYPE))
       ->withTokenCodes(array($key_hash))
       ->withExpired(false)
       ->executeOne();
   }
 
 
   /**
    * Hash a one-time login key for storage as a temporary token.
    *
    * @param PhabricatorUser User this key is for.
    * @param PhabricatorUserEmail Optionally, email to verify when
    *  link is used.
    * @param string The one time login key.
    * @return string Hash of the key.
    * task onetime
    */
   private function getOneTimeLoginKeyHash(
     PhabricatorUser $user,
     PhabricatorUserEmail $email = null,
     $key = null) {
 
     $parts = array(
       $key,
       $user->getAccountSecret(),
     );
 
     if ($email) {
       $parts[] = $email->getVerificationCode();
     }
 
     return PhabricatorHash::digest(implode(':', $parts));
   }
 
 }
diff --git a/src/applications/auth/factor/PhabricatorTOTPAuthFactor.php b/src/applications/auth/factor/PhabricatorTOTPAuthFactor.php
index 519df58ffb..f99a5f4a35 100644
--- a/src/applications/auth/factor/PhabricatorTOTPAuthFactor.php
+++ b/src/applications/auth/factor/PhabricatorTOTPAuthFactor.php
@@ -1,308 +1,308 @@
 <?php
 
 final class PhabricatorTOTPAuthFactor extends PhabricatorAuthFactor {
 
   const TEMPORARY_TOKEN_TYPE = 'mfa:totp:key';
 
   public function getFactorKey() {
     return 'totp';
   }
 
   public function getFactorName() {
     return pht('Mobile Phone App (TOTP)');
   }
 
   public function getFactorDescription() {
     return pht(
       'Attach a mobile authenticator application (like Authy '.
       'or Google Authenticator) to your account. When you need to '.
       'authenticate, you will enter a code shown on your phone.');
   }
 
   public function processAddFactorForm(
     AphrontFormView $form,
     AphrontRequest $request,
     PhabricatorUser $user) {
 
     $key = $request->getStr('totpkey');
     if (strlen($key)) {
       // If the user is providing a key, make sure it's a key we generated.
       // This raises the barrier to theoretical attacks where an attacker might
       // provide a known key (such attacks are already prevented by CSRF, but
       // this is a second barrier to overcome).
 
       // (We store and verify the hash of the key, not the key itself, to limit
       // how useful the data in the table is to an attacker.)
 
       $temporary_token = id(new PhabricatorAuthTemporaryTokenQuery())
         ->setViewer($user)
         ->withObjectPHIDs(array($user->getPHID()))
         ->withTokenTypes(array(self::TEMPORARY_TOKEN_TYPE))
         ->withExpired(false)
         ->withTokenCodes(array(PhabricatorHash::digest($key)))
         ->executeOne();
       if (!$temporary_token) {
         // If we don't have a matching token, regenerate the key below.
         $key = null;
       }
     }
 
     if (!strlen($key)) {
       $key = self::generateNewTOTPKey();
 
       // Mark this key as one we generated, so the user is allowed to submit
       // a response for it.
 
       $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
         id(new PhabricatorAuthTemporaryToken())
           ->setObjectPHID($user->getPHID())
           ->setTokenType(self::TEMPORARY_TOKEN_TYPE)
           ->setTokenExpires(time() + phutil_units('1 hour in seconds'))
           ->setTokenCode(PhabricatorHash::digest($key))
           ->save();
       unset($unguarded);
     }
 
     $code = $request->getStr('totpcode');
 
     $e_code = true;
     if ($request->getExists('totp')) {
       $okay = self::verifyTOTPCode(
         $user,
         new PhutilOpaqueEnvelope($key),
         $code);
 
       if ($okay) {
         $config = $this->newConfigForUser($user)
           ->setFactorName(pht('Mobile App (TOTP)'))
           ->setFactorSecret($key);
 
         return $config;
       } else {
         if (!strlen($code)) {
           $e_code = pht('Required');
         } else {
           $e_code = pht('Invalid');
         }
       }
     }
 
     $form->addHiddenInput('totp', true);
     $form->addHiddenInput('totpkey', $key);
 
     $form->appendRemarkupInstructions(
       pht(
         'First, download an authenticator application on your phone. Two '.
         'applications which work well are **Authy** and **Google '.
         'Authenticator**, but any other TOTP application should also work.'));
 
     $form->appendInstructions(
       pht(
         'Launch the application on your phone, and add a new entry for '.
         'this Phabricator install. When prompted, scan the QR code or '.
         'manually enter the key shown below into the application.'));
 
     $prod_uri = new PhutilURI(PhabricatorEnv::getProductionURI('/'));
     $issuer = $prod_uri->getDomain();
 
     $uri = urisprintf(
       'otpauth://totp/%s:%s?secret=%s&issuer=%s',
       $issuer,
       $user->getUsername(),
       $key,
       $issuer);
 
     $qrcode = $this->renderQRCode($uri);
     $form->appendChild($qrcode);
 
     $form->appendChild(
       id(new AphrontFormStaticControl())
         ->setLabel(pht('Key'))
         ->setValue(phutil_tag('strong', array(), $key)));
 
     $form->appendInstructions(
       pht(
         '(If given an option, select that this key is "Time Based", not '.
         '"Counter Based".)'));
 
     $form->appendInstructions(
       pht(
         'After entering the key, the application should display a numeric '.
         'code. Enter that code below to confirm that you have configured '.
         'the authenticator correctly:'));
 
     $form->appendChild(
       id(new AphrontFormTextControl())
         ->setLabel(pht('TOTP Code'))
         ->setName('totpcode')
         ->setValue($code)
         ->setError($e_code));
 
   }
 
   public function renderValidateFactorForm(
     PhabricatorAuthFactorConfig $config,
     AphrontFormView $form,
     PhabricatorUser $viewer,
     $validation_result) {
 
     if (!$validation_result) {
       $validation_result = array();
     }
 
     $form->appendChild(
       id(new AphrontFormTextControl())
         ->setName($this->getParameterName($config, 'totpcode'))
         ->setLabel(pht('App Code'))
         ->setCaption(pht('Factor Name: %s', $config->getFactorName()))
         ->setValue(idx($validation_result, 'value'))
         ->setError(idx($validation_result, 'error', true)));
   }
 
   public function processValidateFactorForm(
     PhabricatorAuthFactorConfig $config,
     PhabricatorUser $viewer,
     AphrontRequest $request) {
 
     $code = $request->getStr($this->getParameterName($config, 'totpcode'));
     $key = new PhutilOpaqueEnvelope($config->getFactorSecret());
 
     if (self::verifyTOTPCode($viewer, $key, $code)) {
       return array(
         'error' => null,
         'value' => $code,
         'valid' => true,
       );
     } else {
       return array(
         'error' => strlen($code) ? pht('Invalid') : pht('Required'),
         'value' => $code,
         'valid' => false,
       );
     }
   }
 
 
   public static function generateNewTOTPKey() {
     return strtoupper(Filesystem::readRandomCharacters(16));
   }
 
   public static function verifyTOTPCode(
     PhabricatorUser $user,
     PhutilOpaqueEnvelope $key,
     $code) {
 
     // TODO: This should use rate limiting to prevent multiple attempts in a
     // short period of time.
 
     $now = (int)(time() / 30);
 
     // Allow the user to enter a code a few minutes away on either side, in
     // case the server or client has some clock skew.
     for ($offset = -2; $offset <= 2; $offset++) {
       $real = self::getTOTPCode($key, $now + $offset);
-      if ($real === $code) {
+      if (phutil_hashes_are_identical($real, $code)) {
         return true;
       }
     }
 
     // TODO: After validating a code, this should mark it as used and prevent
     // it from being reused.
 
     return false;
   }
 
 
   public static function base32Decode($buf) {
     $buf = strtoupper($buf);
 
     $map = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
     $map = str_split($map);
     $map = array_flip($map);
 
     $out = '';
     $len = strlen($buf);
     $acc = 0;
     $bits = 0;
     for ($ii = 0; $ii < $len; $ii++) {
       $chr = $buf[$ii];
       $val = $map[$chr];
 
       $acc = $acc << 5;
       $acc = $acc + $val;
 
       $bits += 5;
       if ($bits >= 8) {
         $bits = $bits - 8;
         $out .= chr(($acc & (0xFF << $bits)) >> $bits);
       }
     }
 
     return $out;
   }
 
   public static function getTOTPCode(PhutilOpaqueEnvelope $key, $timestamp) {
     $binary_timestamp = pack('N*', 0).pack('N*', $timestamp);
     $binary_key = self::base32Decode($key->openEnvelope());
 
     $hash = hash_hmac('sha1', $binary_timestamp, $binary_key, true);
 
     // See RFC 4226.
 
     $offset = ord($hash[19]) & 0x0F;
 
     $code = ((ord($hash[$offset + 0]) & 0x7F) << 24) |
             ((ord($hash[$offset + 1]) & 0xFF) << 16) |
             ((ord($hash[$offset + 2]) & 0xFF) <<  8) |
             ((ord($hash[$offset + 3])       )      );
 
     $code = ($code % 1000000);
     $code = str_pad($code, 6, '0', STR_PAD_LEFT);
 
     return $code;
   }
 
 
   /**
    * @phutil-external-symbol class QRcode
    */
   private function renderQRCode($uri) {
     $root = dirname(phutil_get_library_root('phabricator'));
     require_once $root.'/externals/phpqrcode/phpqrcode.php';
 
     $lines = QRcode::text($uri);
 
     $total_width = 240;
     $cell_size = floor($total_width / count($lines));
 
     $rows = array();
     foreach ($lines as $line) {
       $cells = array();
       for ($ii = 0; $ii < strlen($line); $ii++) {
         if ($line[$ii] == '1') {
           $color = '#000';
         } else {
           $color = '#fff';
         }
 
         $cells[] = phutil_tag(
           'td',
           array(
             'width' => $cell_size,
             'height' => $cell_size,
             'style' => 'background: '.$color,
           ),
           '');
       }
       $rows[] = phutil_tag('tr', array(), $cells);
     }
 
     return phutil_tag(
       'table',
       array(
         'style' => 'margin: 24px auto;',
       ),
       $rows);
   }
 
 }
diff --git a/src/applications/auth/provider/PhabricatorAuthProvider.php b/src/applications/auth/provider/PhabricatorAuthProvider.php
index 594bb89ea6..55e193f481 100644
--- a/src/applications/auth/provider/PhabricatorAuthProvider.php
+++ b/src/applications/auth/provider/PhabricatorAuthProvider.php
@@ -1,494 +1,494 @@
 <?php
 
 abstract class PhabricatorAuthProvider extends Phobject {
 
   private $providerConfig;
 
   public function attachProviderConfig(PhabricatorAuthProviderConfig $config) {
     $this->providerConfig = $config;
     return $this;
   }
 
   public function hasProviderConfig() {
     return (bool)$this->providerConfig;
   }
 
   public function getProviderConfig() {
     if ($this->providerConfig === null) {
       throw new PhutilInvalidStateException('attachProviderConfig');
     }
     return $this->providerConfig;
   }
 
   public function getConfigurationHelp() {
     return null;
   }
 
   public function getDefaultProviderConfig() {
     return id(new PhabricatorAuthProviderConfig())
       ->setProviderClass(get_class($this))
       ->setIsEnabled(1)
       ->setShouldAllowLogin(1)
       ->setShouldAllowRegistration(1)
       ->setShouldAllowLink(1)
       ->setShouldAllowUnlink(1);
   }
 
   public function getNameForCreate() {
     return $this->getProviderName();
   }
 
   public function getDescriptionForCreate() {
     return null;
   }
 
   public function getProviderKey() {
     return $this->getAdapter()->getAdapterKey();
   }
 
   public function getProviderType() {
     return $this->getAdapter()->getAdapterType();
   }
 
   public function getProviderDomain() {
     return $this->getAdapter()->getAdapterDomain();
   }
 
   public static function getAllBaseProviders() {
     return id(new PhutilClassMapQuery())
       ->setAncestorClass(__CLASS__)
       ->execute();
   }
 
   public static function getAllProviders() {
     static $providers;
 
     if ($providers === null) {
       $objects = self::getAllBaseProviders();
 
       $configs = id(new PhabricatorAuthProviderConfigQuery())
         ->setViewer(PhabricatorUser::getOmnipotentUser())
         ->execute();
 
       $providers = array();
       foreach ($configs as $config) {
         if (!isset($objects[$config->getProviderClass()])) {
           // This configuration is for a provider which is not installed.
           continue;
         }
 
         $object = clone $objects[$config->getProviderClass()];
         $object->attachProviderConfig($config);
 
         $key = $object->getProviderKey();
         if (isset($providers[$key])) {
           throw new Exception(
             pht(
               "Two authentication providers use the same provider key ".
               "('%s'). Each provider must be identified by a unique key.",
               $key));
         }
         $providers[$key] = $object;
       }
     }
 
     return $providers;
   }
 
   public static function getAllEnabledProviders() {
     $providers = self::getAllProviders();
     foreach ($providers as $key => $provider) {
       if (!$provider->isEnabled()) {
         unset($providers[$key]);
       }
     }
     return $providers;
   }
 
   public static function getEnabledProviderByKey($provider_key) {
     return idx(self::getAllEnabledProviders(), $provider_key);
   }
 
   abstract public function getProviderName();
   abstract public function getAdapter();
 
   public function isEnabled() {
     return $this->getProviderConfig()->getIsEnabled();
   }
 
   public function shouldAllowLogin() {
     return $this->getProviderConfig()->getShouldAllowLogin();
   }
 
   public function shouldAllowRegistration() {
     return $this->getProviderConfig()->getShouldAllowRegistration();
   }
 
   public function shouldAllowAccountLink() {
     return $this->getProviderConfig()->getShouldAllowLink();
   }
 
   public function shouldAllowAccountUnlink() {
     return $this->getProviderConfig()->getShouldAllowUnlink();
   }
 
   public function shouldTrustEmails() {
     return $this->shouldAllowEmailTrustConfiguration() &&
            $this->getProviderConfig()->getShouldTrustEmails();
   }
 
   /**
    * Should we allow the adapter to be marked as "trusted". This is true for
    * all adapters except those that allow the user to type in emails (see
    * @{class:PhabricatorPasswordAuthProvider}).
    */
   public function shouldAllowEmailTrustConfiguration() {
     return true;
   }
 
   public function buildLoginForm(PhabricatorAuthStartController $controller) {
     return $this->renderLoginForm($controller->getRequest(), $mode = 'start');
   }
 
   public function buildInviteForm(PhabricatorAuthStartController $controller) {
     return $this->renderLoginForm($controller->getRequest(), $mode = 'invite');
   }
 
   abstract public function processLoginRequest(
     PhabricatorAuthLoginController $controller);
 
   public function buildLinkForm(PhabricatorAuthLinkController $controller) {
     return $this->renderLoginForm($controller->getRequest(), $mode = 'link');
   }
 
   public function shouldAllowAccountRefresh() {
     return true;
   }
 
   public function buildRefreshForm(
     PhabricatorAuthLinkController $controller) {
     return $this->renderLoginForm($controller->getRequest(), $mode = 'refresh');
   }
 
   protected function renderLoginForm(AphrontRequest $request, $mode) {
     throw new PhutilMethodNotImplementedException();
   }
 
   public function createProviders() {
     return array($this);
   }
 
   protected function willSaveAccount(PhabricatorExternalAccount $account) {
     return;
   }
 
   public function willRegisterAccount(PhabricatorExternalAccount $account) {
     return;
   }
 
   protected function loadOrCreateAccount($account_id) {
     if (!strlen($account_id)) {
       throw new Exception(pht('Empty account ID!'));
     }
 
     $adapter = $this->getAdapter();
     $adapter_class = get_class($adapter);
 
     if (!strlen($adapter->getAdapterType())) {
       throw new Exception(
         pht(
           "AuthAdapter (of class '%s') has an invalid implementation: ".
           "no adapter type.",
           $adapter_class));
     }
 
     if (!strlen($adapter->getAdapterDomain())) {
       throw new Exception(
         pht(
           "AuthAdapter (of class '%s') has an invalid implementation: ".
           "no adapter domain.",
           $adapter_class));
     }
 
     $account = id(new PhabricatorExternalAccount())->loadOneWhere(
       'accountType = %s AND accountDomain = %s AND accountID = %s',
       $adapter->getAdapterType(),
       $adapter->getAdapterDomain(),
       $account_id);
     if (!$account) {
       $account = id(new PhabricatorExternalAccount())
         ->setAccountType($adapter->getAdapterType())
         ->setAccountDomain($adapter->getAdapterDomain())
         ->setAccountID($account_id);
     }
 
     $account->setUsername($adapter->getAccountName());
     $account->setRealName($adapter->getAccountRealName());
     $account->setEmail($adapter->getAccountEmail());
     $account->setAccountURI($adapter->getAccountURI());
 
     $account->setProfileImagePHID(null);
     $image_uri = $adapter->getAccountImageURI();
     if ($image_uri) {
       try {
         $name = PhabricatorSlug::normalize($this->getProviderName());
         $name = $name.'-profile.jpg';
 
         // TODO: If the image has not changed, we do not need to make a new
         // file entry for it, but there's no convenient way to do this with
         // PhabricatorFile right now. The storage will get shared, so the impact
         // here is negligible.
         $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
           $image_file = PhabricatorFile::newFromFileDownload(
             $image_uri,
             array(
               'name' => $name,
               'viewPolicy' => PhabricatorPolicies::POLICY_NOONE,
             ));
           if ($image_file->isViewableImage()) {
             $image_file
               ->setViewPolicy(PhabricatorPolicies::getMostOpenPolicy())
               ->setCanCDN(true)
               ->save();
             $account->setProfileImagePHID($image_file->getPHID());
           } else {
             $image_file->delete();
           }
         unset($unguarded);
 
       } catch (Exception $ex) {
         // Log this but proceed, it's not especially important that we
         // be able to pull profile images.
         phlog($ex);
       }
     }
 
     $this->willSaveAccount($account);
 
     $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
     $account->save();
     unset($unguarded);
 
     return $account;
   }
 
   public function getLoginURI() {
     $app = PhabricatorApplication::getByClass('PhabricatorAuthApplication');
     return $app->getApplicationURI('/login/'.$this->getProviderKey().'/');
   }
 
   public function getSettingsURI() {
     return '/settings/panel/external/';
   }
 
   public function getStartURI() {
     $app = PhabricatorApplication::getByClass('PhabricatorAuthApplication');
     $uri = $app->getApplicationURI('/start/');
     return $uri;
   }
 
   public function isDefaultRegistrationProvider() {
     return false;
   }
 
   public function shouldRequireRegistrationPassword() {
     return false;
   }
 
   public function getDefaultExternalAccount() {
     throw new PhutilMethodNotImplementedException();
   }
 
   public function getLoginOrder() {
     return '500-'.$this->getProviderName();
   }
 
   protected function getLoginIcon() {
     return 'Generic';
   }
 
   public function isLoginFormAButton() {
     return false;
   }
 
   public function renderConfigPropertyTransactionTitle(
     PhabricatorAuthProviderConfigTransaction $xaction) {
 
     return null;
   }
 
   public function readFormValuesFromProvider() {
     return array();
   }
 
   public function readFormValuesFromRequest(AphrontRequest $request) {
     return array();
   }
 
   public function processEditForm(
     AphrontRequest $request,
     array $values) {
 
     $errors = array();
     $issues = array();
 
     return array($errors, $issues, $values);
   }
 
   public function extendEditForm(
     AphrontRequest $request,
     AphrontFormView $form,
     array $values,
     array $issues) {
 
     return;
   }
 
   public function willRenderLinkedAccount(
     PhabricatorUser $viewer,
     PHUIObjectItemView $item,
     PhabricatorExternalAccount $account) {
 
     $account_view = id(new PhabricatorAuthAccountView())
       ->setExternalAccount($account)
       ->setAuthProvider($this);
 
     $item->appendChild(
       phutil_tag(
         'div',
         array(
           'class' => 'mmr mml mst mmb',
         ),
         $account_view));
   }
 
   /**
    * Return true to use a two-step configuration (setup, configure) instead of
    * the default single-step configuration. In practice, this means that
    * creating a new provider instance will redirect back to the edit page
    * instead of the provider list.
    *
    * @return bool True if this provider uses two-step configuration.
    */
   public function hasSetupStep() {
     return false;
   }
 
   /**
    * Render a standard login/register button element.
    *
    * The `$attributes` parameter takes these keys:
    *
    *   - `uri`: URI the button should take the user to when clicked.
    *   - `method`: Optional HTTP method the button should use, defaults to GET.
    *
    * @param   AphrontRequest  HTTP request.
    * @param   string          Request mode string.
    * @param   map             Additional parameters, see above.
    * @return  wild            Login button.
    */
   protected function renderStandardLoginButton(
     AphrontRequest $request,
     $mode,
     array $attributes = array()) {
 
     PhutilTypeSpec::checkMap(
       $attributes,
       array(
         'method' => 'optional string',
         'uri' => 'string',
         'sigil' => 'optional string',
       ));
 
     $viewer = $request->getUser();
     $adapter = $this->getAdapter();
 
     if ($mode == 'link') {
       $button_text = pht('Link External Account');
     } else if ($mode == 'refresh') {
       $button_text = pht('Refresh Account Link');
     } else if ($mode == 'invite') {
       $button_text = pht('Register Account');
     } else if ($this->shouldAllowRegistration()) {
       $button_text = pht('Login or Register');
     } else {
       $button_text = pht('Login');
     }
 
     $icon = id(new PHUIIconView())
       ->setSpriteSheet(PHUIIconView::SPRITE_LOGIN)
       ->setSpriteIcon($this->getLoginIcon());
 
     $button = id(new PHUIButtonView())
       ->setSize(PHUIButtonView::BIG)
       ->setColor(PHUIButtonView::GREY)
       ->setIcon($icon)
       ->setText($button_text)
       ->setSubtext($this->getProviderName());
 
     $uri = $attributes['uri'];
     $uri = new PhutilURI($uri);
     $params = $uri->getQueryParams();
     $uri->setQueryParams(array());
 
     $content = array($button);
 
     foreach ($params as $key => $value) {
       $content[] = phutil_tag(
         'input',
         array(
           'type' => 'hidden',
           'name' => $key,
           'value' => $value,
         ));
     }
 
     return phabricator_form(
       $viewer,
       array(
         'method' => idx($attributes, 'method', 'GET'),
         'action' => (string)$uri,
         'sigil'  => idx($attributes, 'sigil'),
       ),
       $content);
   }
 
   public function renderConfigurationFooter() {
     return null;
   }
 
   public function getAuthCSRFCode(AphrontRequest $request) {
     $phcid = $request->getCookie(PhabricatorCookies::COOKIE_CLIENTID);
     if (!strlen($phcid)) {
       throw new Exception(
         pht(
           'Your browser did not submit a "%s" cookie with client state '.
           'information in the request. Check that cookies are enabled. '.
           'If this problem persists, you may need to clear your cookies.',
           PhabricatorCookies::COOKIE_CLIENTID));
     }
 
     return PhabricatorHash::digest($phcid);
   }
 
   protected function verifyAuthCSRFCode(AphrontRequest $request, $actual) {
     $expect = $this->getAuthCSRFCode($request);
 
     if (!strlen($actual)) {
       throw new Exception(
         pht(
           'The authentication provider did not return a client state '.
           'parameter in its response, but one was expected. If this '.
           'problem persists, you may need to clear your cookies.'));
     }
 
-    if ($actual !== $expect) {
+    if (!phutil_hashes_are_identical($actual, $expect)) {
       throw new Exception(
         pht(
           'The authentication provider did not return the correct client '.
           'state parameter in its response. If this problem persists, you may '.
           'need to clear your cookies.'));
     }
   }
 
 }
diff --git a/src/applications/conduit/controller/PhabricatorConduitAPIController.php b/src/applications/conduit/controller/PhabricatorConduitAPIController.php
index 41106d110b..4bbe167c39 100644
--- a/src/applications/conduit/controller/PhabricatorConduitAPIController.php
+++ b/src/applications/conduit/controller/PhabricatorConduitAPIController.php
@@ -1,660 +1,661 @@
 <?php
 
 final class PhabricatorConduitAPIController
   extends PhabricatorConduitController {
 
   public function shouldRequireLogin() {
     return false;
   }
 
   private $method;
 
   public function willProcessRequest(array $data) {
     $this->method = $data['method'];
     return $this;
   }
 
   public function processRequest() {
     $time_start = microtime(true);
     $request = $this->getRequest();
 
     $method = $this->method;
 
     $api_request = null;
     $method_implementation = null;
 
     $log = new PhabricatorConduitMethodCallLog();
     $log->setMethod($method);
     $metadata = array();
 
     $multimeter = MultimeterControl::getInstance();
     if ($multimeter) {
       $multimeter->setEventContext('api.'.$method);
     }
 
     try {
 
       list($metadata, $params) = $this->decodeConduitParams($request, $method);
 
       $call = new ConduitCall($method, $params);
       $method_implementation = $call->getMethodImplementation();
 
       $result = null;
 
       // TODO: The relationship between ConduitAPIRequest and ConduitCall is a
       // little odd here and could probably be improved. Specifically, the
       // APIRequest is a sub-object of the Call, which does not parallel the
       // role of AphrontRequest (which is an indepenent object).
       // In particular, the setUser() and getUser() existing independently on
       // the Call and APIRequest is very awkward.
 
       $api_request = $call->getAPIRequest();
 
       $allow_unguarded_writes = false;
       $auth_error = null;
       $conduit_username = '-';
       if ($call->shouldRequireAuthentication()) {
         $metadata['scope'] = $call->getRequiredScope();
         $auth_error = $this->authenticateUser($api_request, $metadata);
         // If we've explicitly authenticated the user here and either done
         // CSRF validation or are using a non-web authentication mechanism.
         $allow_unguarded_writes = true;
 
         if ($auth_error === null) {
           $conduit_user = $api_request->getUser();
           if ($conduit_user && $conduit_user->getPHID()) {
             $conduit_username = $conduit_user->getUsername();
           }
           $call->setUser($api_request->getUser());
         }
       }
 
       $access_log = PhabricatorAccessLog::getLog();
       if ($access_log) {
         $access_log->setData(
           array(
             'u' => $conduit_username,
             'm' => $method,
           ));
       }
 
       if ($call->shouldAllowUnguardedWrites()) {
         $allow_unguarded_writes = true;
       }
 
       if ($auth_error === null) {
         if ($allow_unguarded_writes) {
           $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
         }
 
         try {
           $result = $call->execute();
           $error_code = null;
           $error_info = null;
         } catch (ConduitException $ex) {
           $result = null;
           $error_code = $ex->getMessage();
           if ($ex->getErrorDescription()) {
             $error_info = $ex->getErrorDescription();
           } else {
             $error_info = $call->getErrorDescription($error_code);
           }
         }
         if ($allow_unguarded_writes) {
           unset($unguarded);
         }
       } else {
         list($error_code, $error_info) = $auth_error;
       }
     } catch (Exception $ex) {
       if (!($ex instanceof ConduitMethodNotFoundException)) {
         phlog($ex);
       }
       $result = null;
       $error_code = ($ex instanceof ConduitException
         ? 'ERR-CONDUIT-CALL'
         : 'ERR-CONDUIT-CORE');
       $error_info = $ex->getMessage();
     }
 
     $time_end = microtime(true);
 
     $connection_id = null;
     if (idx($metadata, 'connectionID')) {
       $connection_id = $metadata['connectionID'];
     } else if (($method == 'conduit.connect') && $result) {
       $connection_id = idx($result, 'connectionID');
     }
 
     $log
       ->setCallerPHID(
         isset($conduit_user)
           ? $conduit_user->getPHID()
           : null)
       ->setConnectionID($connection_id)
       ->setError((string)$error_code)
       ->setDuration(1000000 * ($time_end - $time_start));
 
     $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
     $log->save();
     unset($unguarded);
 
     $response = id(new ConduitAPIResponse())
       ->setResult($result)
       ->setErrorCode($error_code)
       ->setErrorInfo($error_info);
 
     switch ($request->getStr('output')) {
       case 'human':
         return $this->buildHumanReadableResponse(
           $method,
           $api_request,
           $response->toDictionary(),
           $method_implementation);
       case 'json':
       default:
         return id(new AphrontJSONResponse())
           ->setAddJSONShield(false)
           ->setContent($response->toDictionary());
     }
   }
 
   /**
    * Authenticate the client making the request to a Phabricator user account.
    *
    * @param   ConduitAPIRequest Request being executed.
    * @param   dict              Request metadata.
    * @return  null|pair         Null to indicate successful authentication, or
    *                            an error code and error message pair.
    */
   private function authenticateUser(
     ConduitAPIRequest $api_request,
     array $metadata) {
 
     $request = $this->getRequest();
 
     if ($request->getUser()->getPHID()) {
       $request->validateCSRF();
       return $this->validateAuthenticatedUser(
         $api_request,
         $request->getUser());
     }
 
     $auth_type = idx($metadata, 'auth.type');
     if ($auth_type === ConduitClient::AUTH_ASYMMETRIC) {
       $host = idx($metadata, 'auth.host');
       if (!$host) {
         return array(
           'ERR-INVALID-AUTH',
           pht(
             'Request is missing required "%s" parameter.',
             'auth.host'),
         );
       }
 
       // TODO: Validate that we are the host!
 
       $raw_key = idx($metadata, 'auth.key');
       $public_key = PhabricatorAuthSSHPublicKey::newFromRawKey($raw_key);
       $ssl_public_key = $public_key->toPKCS8();
 
       // First, verify the signature.
       try {
         $protocol_data = $metadata;
 
         // TODO: We should stop writing this into the protocol data when
         // processing a request.
         unset($protocol_data['scope']);
 
         ConduitClient::verifySignature(
           $this->method,
           $api_request->getAllParameters(),
           $protocol_data,
           $ssl_public_key);
       } catch (Exception $ex) {
         return array(
           'ERR-INVALID-AUTH',
           pht(
             'Signature verification failure. %s',
             $ex->getMessage()),
         );
       }
 
       // If the signature is valid, find the user or device which is
       // associated with this public key.
 
       $stored_key = id(new PhabricatorAuthSSHKeyQuery())
         ->setViewer(PhabricatorUser::getOmnipotentUser())
         ->withKeys(array($public_key))
         ->executeOne();
       if (!$stored_key) {
         return array(
           'ERR-INVALID-AUTH',
           pht('No user or device is associated with that public key.'),
         );
       }
 
       $object = $stored_key->getObject();
 
       if ($object instanceof PhabricatorUser) {
         $user = $object;
       } else {
         if (!$stored_key->getIsTrusted()) {
           return array(
             'ERR-INVALID-AUTH',
             pht(
               'The key which signed this request is not trusted. Only '.
               'trusted keys can be used to sign API calls.'),
           );
         }
 
         if (!PhabricatorEnv::isClusterRemoteAddress()) {
           return array(
             'ERR-INVALID-AUTH',
             pht(
               'This request originates from outside of the Phabricator '.
               'cluster address range. Requests signed with trusted '.
               'device keys must originate from within the cluster.'),
           );
         }
 
         $user = PhabricatorUser::getOmnipotentUser();
 
         // Flag this as an intracluster request.
         $api_request->setIsClusterRequest(true);
       }
 
       return $this->validateAuthenticatedUser(
         $api_request,
         $user);
     } else if ($auth_type === null) {
       // No specified authentication type, continue with other authentication
       // methods below.
     } else {
       return array(
         'ERR-INVALID-AUTH',
         pht(
           'Provided "%s" ("%s") is not recognized.',
           'auth.type',
           $auth_type),
       );
     }
 
     $token_string = idx($metadata, 'token');
     if (strlen($token_string)) {
 
       if (strlen($token_string) != 32) {
         return array(
           'ERR-INVALID-AUTH',
           pht(
             'API token "%s" has the wrong length. API tokens should be '.
             '32 characters long.',
             $token_string),
         );
       }
 
       $type = head(explode('-', $token_string));
       $valid_types = PhabricatorConduitToken::getAllTokenTypes();
       $valid_types = array_fuse($valid_types);
       if (empty($valid_types[$type])) {
         return array(
           'ERR-INVALID-AUTH',
           pht(
             'API token "%s" has the wrong format. API tokens should be '.
             '32 characters long and begin with one of these prefixes: %s.',
             $token_string,
             implode(', ', $valid_types)),
           );
       }
 
       $token = id(new PhabricatorConduitTokenQuery())
         ->setViewer(PhabricatorUser::getOmnipotentUser())
         ->withTokens(array($token_string))
         ->withExpired(false)
         ->executeOne();
       if (!$token) {
         $token = id(new PhabricatorConduitTokenQuery())
           ->setViewer(PhabricatorUser::getOmnipotentUser())
           ->withTokens(array($token_string))
           ->withExpired(true)
           ->executeOne();
         if ($token) {
           return array(
             'ERR-INVALID-AUTH',
             pht(
               'API token "%s" was previously valid, but has expired.',
               $token_string),
           );
         } else {
           return array(
             'ERR-INVALID-AUTH',
             pht(
               'API token "%s" is not valid.',
               $token_string),
           );
         }
       }
 
       // If this is a "cli-" token, it expires shortly after it is generated
       // by default. Once it is actually used, we extend its lifetime and make
       // it permanent. This allows stray tokens to get cleaned up automatically
       // if they aren't being used.
       if ($token->getTokenType() == PhabricatorConduitToken::TYPE_COMMANDLINE) {
         if ($token->getExpires()) {
           $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
             $token->setExpires(null);
             $token->save();
           unset($unguarded);
         }
       }
 
       // If this is a "clr-" token, Phabricator must be configured in cluster
       // mode and the remote address must be a cluster node.
       if ($token->getTokenType() == PhabricatorConduitToken::TYPE_CLUSTER) {
         if (!PhabricatorEnv::isClusterRemoteAddress()) {
           return array(
             'ERR-INVALID-AUTH',
             pht(
               'This request originates from outside of the Phabricator '.
               'cluster address range. Requests signed with cluster API '.
               'tokens must originate from within the cluster.'),
           );
         }
 
         // Flag this as an intracluster request.
         $api_request->setIsClusterRequest(true);
       }
 
       $user = $token->getObject();
       if (!($user instanceof PhabricatorUser)) {
         return array(
           'ERR-INVALID-AUTH',
           pht('API token is not associated with a valid user.'),
         );
       }
 
       return $this->validateAuthenticatedUser(
         $api_request,
         $user);
     }
 
     // handle oauth
     $access_token = idx($metadata, 'access_token');
     $method_scope = idx($metadata, 'scope');
     if ($access_token &&
         $method_scope != PhabricatorOAuthServerScope::SCOPE_NOT_ACCESSIBLE) {
       $token = id(new PhabricatorOAuthServerAccessToken())
         ->loadOneWhere('token = %s', $access_token);
       if (!$token) {
         return array(
           'ERR-INVALID-AUTH',
           pht('Access token does not exist.'),
         );
       }
 
       $oauth_server = new PhabricatorOAuthServer();
       $valid = $oauth_server->validateAccessToken($token,
                                                   $method_scope);
       if (!$valid) {
         return array(
           'ERR-INVALID-AUTH',
           pht('Access token is invalid.'),
         );
       }
 
       // valid token, so let's log in the user!
       $user_phid = $token->getUserPHID();
       $user = id(new PhabricatorUser())
         ->loadOneWhere('phid = %s', $user_phid);
       if (!$user) {
         return array(
           'ERR-INVALID-AUTH',
           pht('Access token is for invalid user.'),
         );
       }
       return $this->validateAuthenticatedUser(
         $api_request,
         $user);
     }
 
     // Handle sessionless auth.
     // TODO: This is super messy.
     // TODO: Remove this in favor of token-based auth.
 
     if (isset($metadata['authUser'])) {
       $user = id(new PhabricatorUser())->loadOneWhere(
         'userName = %s',
         $metadata['authUser']);
       if (!$user) {
         return array(
           'ERR-INVALID-AUTH',
           pht('Authentication is invalid.'),
         );
       }
       $token = idx($metadata, 'authToken');
       $signature = idx($metadata, 'authSignature');
       $certificate = $user->getConduitCertificate();
-      if (sha1($token.$certificate) !== $signature) {
+      $hash = sha1($token.$certificate);
+      if (!phutil_hashes_are_identical($hash, $signature)) {
         return array(
           'ERR-INVALID-AUTH',
           pht('Authentication is invalid.'),
         );
       }
       return $this->validateAuthenticatedUser(
         $api_request,
         $user);
     }
 
     // Handle session-based auth.
     // TODO: Remove this in favor of token-based auth.
 
     $session_key = idx($metadata, 'sessionKey');
     if (!$session_key) {
       return array(
         'ERR-INVALID-SESSION',
         pht('Session key is not present.'),
       );
     }
 
     $user = id(new PhabricatorAuthSessionEngine())
       ->loadUserForSession(PhabricatorAuthSession::TYPE_CONDUIT, $session_key);
 
     if (!$user) {
       return array(
         'ERR-INVALID-SESSION',
         pht('Session key is invalid.'),
       );
     }
 
     return $this->validateAuthenticatedUser(
       $api_request,
       $user);
   }
 
   private function validateAuthenticatedUser(
     ConduitAPIRequest $request,
     PhabricatorUser $user) {
 
     if (!$user->canEstablishAPISessions()) {
       return array(
         'ERR-INVALID-AUTH',
         pht('User account is not permitted to use the API.'),
       );
     }
 
     $request->setUser($user);
     return null;
   }
 
   private function buildHumanReadableResponse(
     $method,
     ConduitAPIRequest $request = null,
     $result = null,
     ConduitAPIMethod $method_implementation = null) {
 
     $param_rows = array();
     $param_rows[] = array('Method', $this->renderAPIValue($method));
     if ($request) {
       foreach ($request->getAllParameters() as $key => $value) {
         $param_rows[] = array(
           $key,
           $this->renderAPIValue($value),
         );
       }
     }
 
     $param_table = new AphrontTableView($param_rows);
     $param_table->setColumnClasses(
       array(
         'header',
         'wide',
       ));
 
     $result_rows = array();
     foreach ($result as $key => $value) {
       $result_rows[] = array(
         $key,
         $this->renderAPIValue($value),
       );
     }
 
     $result_table = new AphrontTableView($result_rows);
     $result_table->setColumnClasses(
       array(
         'header',
         'wide',
       ));
 
     $param_panel = new PHUIObjectBoxView();
     $param_panel->setHeaderText(pht('Method Parameters'));
     $param_panel->setTable($param_table);
 
     $result_panel = new PHUIObjectBoxView();
     $result_panel->setHeaderText(pht('Method Result'));
     $result_panel->setTable($result_table);
 
     $method_uri = $this->getApplicationURI('method/'.$method.'/');
 
     $crumbs = $this->buildApplicationCrumbs()
       ->addTextCrumb($method, $method_uri)
       ->addTextCrumb(pht('Call'));
 
     $example_panel = null;
     if ($request && $method_implementation) {
       $params = $request->getAllParameters();
       $example_panel = $this->renderExampleBox(
         $method_implementation,
         $params);
     }
 
     return $this->buildApplicationPage(
       array(
         $crumbs,
         $param_panel,
         $result_panel,
         $example_panel,
       ),
       array(
         'title' => pht('Method Call Result'),
       ));
   }
 
   private function renderAPIValue($value) {
     $json = new PhutilJSON();
     if (is_array($value)) {
       $value = $json->encodeFormatted($value);
     }
 
     $value = phutil_tag(
       'pre',
       array('style' => 'white-space: pre-wrap;'),
       $value);
 
     return $value;
   }
 
   private function decodeConduitParams(
     AphrontRequest $request,
     $method) {
 
     // Look for parameters from the Conduit API Console, which are encoded
     // as HTTP POST parameters in an array, e.g.:
     //
     //   params[name]=value&params[name2]=value2
     //
     // The fields are individually JSON encoded, since we require users to
     // enter JSON so that we avoid type ambiguity.
 
     $params = $request->getArr('params', null);
     if ($params !== null) {
       foreach ($params as $key => $value) {
         if ($value == '') {
           // Interpret empty string null (e.g., the user didn't type anything
           // into the box).
           $value = 'null';
         }
         $decoded_value = json_decode($value, true);
         if ($decoded_value === null && strtolower($value) != 'null') {
           // When json_decode() fails, it returns null. This almost certainly
           // indicates that a user was using the web UI and didn't put quotes
           // around a string value. We can either do what we think they meant
           // (treat it as a string) or fail. For now, err on the side of
           // caution and fail. In the future, if we make the Conduit API
           // actually do type checking, it might be reasonable to treat it as
           // a string if the parameter type is string.
           throw new Exception(
             pht(
               "The value for parameter '%s' is not valid JSON. All ".
               "parameters must be encoded as JSON values, including strings ".
               "(which means you need to surround them in double quotes). ".
               "Check your syntax. Value was: %s.",
               $key,
               $value));
         }
         $params[$key] = $decoded_value;
       }
 
       $metadata = idx($params, '__conduit__', array());
       unset($params['__conduit__']);
 
       return array($metadata, $params);
     }
 
     // Otherwise, look for a single parameter called 'params' which has the
     // entire param dictionary JSON encoded.
     $params_json = $request->getStr('params');
     if (strlen($params_json)) {
       $params = null;
       try {
         $params = phutil_json_decode($params_json);
       } catch (PhutilJSONParserException $ex) {
         throw new PhutilProxyException(
           pht(
             "Invalid parameter information was passed to method '%s'.",
             $method),
           $ex);
       }
 
       $metadata = idx($params, '__conduit__', array());
       unset($params['__conduit__']);
 
       return array($metadata, $params);
     }
 
     // If we do not have `params`, assume this is a simple HTTP request with
     // HTTP key-value pairs.
     $params = array();
     $metadata = array();
     foreach ($request->getPassthroughRequestData() as $key => $value) {
       $meta_key = ConduitAPIMethod::getParameterMetadataKey($key);
       if ($meta_key !== null) {
         $metadata[$meta_key] = $value;
       } else {
         $params[$key] = $value;
       }
     }
 
     return array($metadata, $params);
   }
 
 }
diff --git a/src/applications/conduit/method/ConduitConnectConduitAPIMethod.php b/src/applications/conduit/method/ConduitConnectConduitAPIMethod.php
index a6ec09ae09..9f57365d38 100644
--- a/src/applications/conduit/method/ConduitConnectConduitAPIMethod.php
+++ b/src/applications/conduit/method/ConduitConnectConduitAPIMethod.php
@@ -1,163 +1,163 @@
 <?php
 
 final class ConduitConnectConduitAPIMethod extends ConduitAPIMethod {
 
   public function getAPIMethodName() {
     return 'conduit.connect';
   }
 
   public function shouldRequireAuthentication() {
     return false;
   }
 
   public function shouldAllowUnguardedWrites() {
     return true;
   }
 
   public function getMethodDescription() {
     return pht('Connect a session-based client.');
   }
 
   protected function defineParamTypes() {
     return array(
       'client'              => 'required string',
       'clientVersion'       => 'required int',
       'clientDescription'   => 'optional string',
       'user'                => 'optional string',
       'authToken'           => 'optional int',
       'authSignature'       => 'optional string',
       'host'                => 'deprecated',
     );
   }
 
   protected function defineReturnType() {
     return 'dict<string, any>';
   }
 
   protected function defineErrorTypes() {
     return array(
       'ERR-BAD-VERSION' => pht(
         'Client/server version mismatch. Upgrade your server or downgrade '.
         'your client.'),
       'NEW-ARC-VERSION' => pht(
         'Client/server version mismatch. Upgrade your client.'),
       'ERR-UNKNOWN-CLIENT' => pht('Client is unknown.'),
       'ERR-INVALID-USER' => pht(
         'The username you are attempting to authenticate with is not valid.'),
       'ERR-INVALID-CERTIFICATE' => pht(
         'Your authentication certificate for this server is invalid.'),
       'ERR-INVALID-TOKEN' => pht(
         "The challenge token you are authenticating with is outside of the ".
         "allowed time range. Either your system clock is out of whack or ".
         "you're executing a replay attack."),
       'ERR-NO-CERTIFICATE' => pht('This server requires authentication.'),
     );
   }
 
   protected function execute(ConduitAPIRequest $request) {
     $client = $request->getValue('client');
     $client_version = (int)$request->getValue('clientVersion');
     $client_description = (string)$request->getValue('clientDescription');
     $client_description = id(new PhutilUTF8StringTruncator())
       ->setMaximumBytes(255)
       ->truncateString($client_description);
     $username = (string)$request->getValue('user');
 
     // Log the connection, regardless of the outcome of checks below.
     $connection = new PhabricatorConduitConnectionLog();
     $connection->setClient($client);
     $connection->setClientVersion($client_version);
     $connection->setClientDescription($client_description);
     $connection->setUsername($username);
     $connection->save();
 
     switch ($client) {
       case 'arc':
         $server_version = 6;
         $supported_versions = array(
           $server_version => true,
           // Client version 5 introduced "user.query" call
           4               => true,
           // Client version 6 introduced "diffusion.getlintmessages" call
           5               => true,
         );
 
         if (empty($supported_versions[$client_version])) {
           if ($server_version < $client_version) {
             $ex = new ConduitException('ERR-BAD-VERSION');
             $ex->setErrorDescription(
               pht(
                 "Your '%s' client version is '%d', which is newer than the ".
                 "server version, '%d'. Upgrade your Phabricator install.",
                 'arc',
                 $client_version,
                 $server_version));
           } else {
             $ex = new ConduitException('NEW-ARC-VERSION');
             $ex->setErrorDescription(
               pht(
                 'A new version of arc is available! You need to upgrade '.
                 'to connect to this server (you are running version '.
                 '%d, the server is running version %d).',
                 $client_version,
                 $server_version));
           }
           throw $ex;
         }
         break;
       default:
         // Allow new clients by default.
         break;
     }
 
     $token = $request->getValue('authToken');
     $signature = $request->getValue('authSignature');
 
     $user = id(new PhabricatorUser())->loadOneWhere('username = %s', $username);
     if (!$user) {
       throw new ConduitException('ERR-INVALID-USER');
     }
 
     $session_key = null;
     if ($token && $signature) {
       $threshold = 60 * 15;
       $now = time();
       if (abs($token - $now) > $threshold) {
         throw id(new ConduitException('ERR-INVALID-TOKEN'))
           ->setErrorDescription(
             pht(
               'The request you submitted is signed with a timestamp, but that '.
               'timestamp is not within %s of the current time. The '.
               'signed timestamp is %s (%s), and the current server time is '.
               '%s (%s). This is a difference of %s seconds, but the '.
               'timestamp must differ from the server time by no more than '.
               '%s seconds. Your client or server clock may not be set '.
               'correctly.',
               phutil_format_relative_time($threshold),
               $token,
               date('r', $token),
               $now,
               date('r', $now),
               ($token - $now),
               $threshold));
       }
       $valid = sha1($token.$user->getConduitCertificate());
-      if ($valid != $signature) {
+      if (!phutil_hashes_are_identical($valid, $signature)) {
         throw new ConduitException('ERR-INVALID-CERTIFICATE');
       }
       $session_key = id(new PhabricatorAuthSessionEngine())->establishSession(
         PhabricatorAuthSession::TYPE_CONDUIT,
         $user->getPHID(),
         $partial = false);
     } else {
       throw new ConduitException('ERR-NO-CERTIFICATE');
     }
 
     return array(
       'connectionID'  => $connection->getID(),
       'sessionKey'    => $session_key,
       'userPHID'      => $user->getPHID(),
     );
   }
 
 }
diff --git a/src/applications/metamta/controller/PhabricatorMetaMTAMailgunReceiveController.php b/src/applications/metamta/controller/PhabricatorMetaMTAMailgunReceiveController.php
index 104fb128a8..0c353bf543 100644
--- a/src/applications/metamta/controller/PhabricatorMetaMTAMailgunReceiveController.php
+++ b/src/applications/metamta/controller/PhabricatorMetaMTAMailgunReceiveController.php
@@ -1,76 +1,78 @@
 <?php
 
 final class PhabricatorMetaMTAMailgunReceiveController
   extends PhabricatorMetaMTAController {
 
   public function shouldRequireLogin() {
     return false;
   }
 
   private function verifyMessage() {
     $api_key = PhabricatorEnv::getEnvConfig('mailgun.api-key');
     $request = $this->getRequest();
     $timestamp = $request->getStr('timestamp');
     $token = $request->getStr('token');
     $sig = $request->getStr('signature');
-    return hash_hmac('sha256', $timestamp.$token, $api_key) == $sig;
+    $hash = hash_hmac('sha256', $timestamp.$token, $api_key);
 
+    return phutil_hashes_are_identical($sig, $hash);
   }
+
   public function processRequest() {
 
     // No CSRF for Mailgun.
     $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
 
     if (!$this->verifyMessage()) {
       throw new Exception(
         pht('Mail signature is not valid. Check your Mailgun API key.'));
     }
 
     $request = $this->getRequest();
     $user = $request->getUser();
 
     $raw_headers = $request->getStr('headers');
     $raw_headers = explode("\n", rtrim($raw_headers));
     $raw_dict = array();
     foreach (array_filter($raw_headers) as $header) {
       list($name, $value) = explode(':', $header, 2);
       $raw_dict[$name] = ltrim($value);
     }
 
     $headers = array(
       'to'      => $request->getStr('recipient'),
       'from'    => $request->getStr('from'),
       'subject' => $request->getStr('subject'),
     ) + $raw_dict;
 
     $received = new PhabricatorMetaMTAReceivedMail();
     $received->setHeaders($headers);
     $received->setBodies(array(
       'text' => $request->getStr('stripped-text'),
       'html' => $request->getStr('stripped-html'),
     ));
 
     $file_phids = array();
     foreach ($_FILES as $file_raw) {
       try {
         $file = PhabricatorFile::newFromPHPUpload(
           $file_raw,
           array(
             'viewPolicy' => PhabricatorPolicies::POLICY_NOONE,
           ));
         $file_phids[] = $file->getPHID();
       } catch (Exception $ex) {
         phlog($ex);
       }
     }
     $received->setAttachments($file_phids);
     $received->save();
 
     $received->processReceivedMail();
 
     $response = new AphrontWebpageResponse();
     $response->setContent(pht("Got it! Thanks, Mailgun!\n"));
     return $response;
   }
 
 }
diff --git a/src/applications/people/storage/PhabricatorUser.php b/src/applications/people/storage/PhabricatorUser.php
index 148a2168b4..82d17983e8 100644
--- a/src/applications/people/storage/PhabricatorUser.php
+++ b/src/applications/people/storage/PhabricatorUser.php
@@ -1,1319 +1,1305 @@
 <?php
 
 /**
  * @task availability Availability
  * @task image-cache Profile Image Cache
  * @task factors Multi-Factor Authentication
  * @task handles Managing Handles
  */
 final class PhabricatorUser
   extends PhabricatorUserDAO
   implements
     PhutilPerson,
     PhabricatorPolicyInterface,
     PhabricatorCustomFieldInterface,
     PhabricatorDestructibleInterface,
     PhabricatorSSHPublicKeyInterface,
     PhabricatorFlaggableInterface,
     PhabricatorApplicationTransactionInterface {
 
   const SESSION_TABLE = 'phabricator_session';
   const NAMETOKEN_TABLE = 'user_nametoken';
   const MAXIMUM_USERNAME_LENGTH = 64;
 
   protected $userName;
   protected $realName;
   protected $sex;
   protected $translation;
   protected $passwordSalt;
   protected $passwordHash;
   protected $profileImagePHID;
   protected $profileImageCache;
   protected $availabilityCache;
   protected $availabilityCacheTTL;
   protected $timezoneIdentifier = '';
 
   protected $consoleEnabled = 0;
   protected $consoleVisible = 0;
   protected $consoleTab = '';
 
   protected $conduitCertificate;
 
   protected $isSystemAgent = 0;
   protected $isMailingList = 0;
   protected $isAdmin = 0;
   protected $isDisabled = 0;
   protected $isEmailVerified = 0;
   protected $isApproved = 0;
   protected $isEnrolledInMultiFactor = 0;
 
   protected $accountSecret;
 
   private $profileImage = self::ATTACHABLE;
   private $profile = null;
   private $availability = self::ATTACHABLE;
   private $preferences = null;
   private $omnipotent = false;
   private $customFields = self::ATTACHABLE;
   private $badgePHIDs = self::ATTACHABLE;
 
   private $alternateCSRFString = self::ATTACHABLE;
   private $session = self::ATTACHABLE;
 
   private $authorities = array();
   private $handlePool;
   private $csrfSalt;
 
   protected function readField($field) {
     switch ($field) {
       case 'timezoneIdentifier':
         // If the user hasn't set one, guess the server's time.
         return nonempty(
           $this->timezoneIdentifier,
           date_default_timezone_get());
       // Make sure these return booleans.
       case 'isAdmin':
         return (bool)$this->isAdmin;
       case 'isDisabled':
         return (bool)$this->isDisabled;
       case 'isSystemAgent':
         return (bool)$this->isSystemAgent;
       case 'isMailingList':
         return (bool)$this->isMailingList;
       case 'isEmailVerified':
         return (bool)$this->isEmailVerified;
       case 'isApproved':
         return (bool)$this->isApproved;
       default:
         return parent::readField($field);
     }
   }
 
 
   /**
    * Is this a live account which has passed required approvals? Returns true
    * if this is an enabled, verified (if required), approved (if required)
    * account, and false otherwise.
    *
    * @return bool True if this is a standard, usable account.
    */
   public function isUserActivated() {
     if ($this->isOmnipotent()) {
       return true;
     }
 
     if ($this->getIsDisabled()) {
       return false;
     }
 
     if (!$this->getIsApproved()) {
       return false;
     }
 
     if (PhabricatorUserEmail::isEmailVerificationRequired()) {
       if (!$this->getIsEmailVerified()) {
         return false;
       }
     }
 
     return true;
   }
 
   public function canEstablishWebSessions() {
     if ($this->getIsMailingList()) {
       return false;
     }
 
     if ($this->getIsSystemAgent()) {
       return false;
     }
 
     return true;
   }
 
   public function canEstablishAPISessions() {
     if (!$this->isUserActivated()) {
       return false;
     }
 
     if ($this->getIsMailingList()) {
       return false;
     }
 
     return true;
   }
 
   public function canEstablishSSHSessions() {
     if (!$this->isUserActivated()) {
       return false;
     }
 
     if ($this->getIsMailingList()) {
       return false;
     }
 
     return true;
   }
 
   /**
    * Returns `true` if this is a standard user who is logged in. Returns `false`
    * for logged out, anonymous, or external users.
    *
    * @return bool `true` if the user is a standard user who is logged in with
    *              a normal session.
    */
   public function getIsStandardUser() {
     $type_user = PhabricatorPeopleUserPHIDType::TYPECONST;
     return $this->getPHID() && (phid_get_type($this->getPHID()) == $type_user);
   }
 
   protected function getConfiguration() {
     return array(
       self::CONFIG_AUX_PHID => true,
       self::CONFIG_COLUMN_SCHEMA => array(
         'userName' => 'sort64',
         'realName' => 'text128',
         'sex' => 'text4?',
         'translation' => 'text64?',
         'passwordSalt' => 'text32?',
         'passwordHash' => 'text128?',
         'profileImagePHID' => 'phid?',
         'consoleEnabled' => 'bool',
         'consoleVisible' => 'bool',
         'consoleTab' => 'text64',
         'conduitCertificate' => 'text255',
         'isSystemAgent' => 'bool',
         'isMailingList' => 'bool',
         'isDisabled' => 'bool',
         'isAdmin' => 'bool',
         'timezoneIdentifier' => 'text255',
         'isEmailVerified' => 'uint32',
         'isApproved' => 'uint32',
         'accountSecret' => 'bytes64',
         'isEnrolledInMultiFactor' => 'bool',
         'profileImageCache' => 'text255?',
         'availabilityCache' => 'text255?',
         'availabilityCacheTTL' => 'uint32?',
       ),
       self::CONFIG_KEY_SCHEMA => array(
         'key_phid' => null,
         'phid' => array(
           'columns' => array('phid'),
           'unique' => true,
         ),
         'userName' => array(
           'columns' => array('userName'),
           'unique' => true,
         ),
         'realName' => array(
           'columns' => array('realName'),
         ),
         'key_approved' => array(
           'columns' => array('isApproved'),
         ),
       ),
       self::CONFIG_NO_MUTATE => array(
         'profileImageCache' => true,
         'availabilityCache' => true,
         'availabilityCacheTTL' => true,
       ),
     ) + parent::getConfiguration();
   }
 
   public function generatePHID() {
     return PhabricatorPHID::generateNewPHID(
       PhabricatorPeopleUserPHIDType::TYPECONST);
   }
 
   public function setPassword(PhutilOpaqueEnvelope $envelope) {
     if (!$this->getPHID()) {
       throw new Exception(
         pht(
           'You can not set a password for an unsaved user because their PHID '.
           'is a salt component in the password hash.'));
     }
 
     if (!strlen($envelope->openEnvelope())) {
       $this->setPasswordHash('');
     } else {
       $this->setPasswordSalt(md5(Filesystem::readRandomBytes(32)));
       $hash = $this->hashPassword($envelope);
       $this->setPasswordHash($hash->openEnvelope());
     }
     return $this;
   }
 
   // To satisfy PhutilPerson.
   public function getSex() {
     return $this->sex;
   }
 
   public function getMonogram() {
     return '@'.$this->getUsername();
   }
 
   public function isLoggedIn() {
     return !($this->getPHID() === null);
   }
 
   public function save() {
     if (!$this->getConduitCertificate()) {
       $this->setConduitCertificate($this->generateConduitCertificate());
     }
 
     if (!strlen($this->getAccountSecret())) {
       $this->setAccountSecret(Filesystem::readRandomCharacters(64));
     }
 
     $result = parent::save();
 
     if ($this->profile) {
       $this->profile->save();
     }
 
     $this->updateNameTokens();
 
     id(new PhabricatorSearchIndexer())
       ->queueDocumentForIndexing($this->getPHID());
 
     return $result;
   }
 
   public function attachSession(PhabricatorAuthSession $session) {
     $this->session = $session;
     return $this;
   }
 
   public function getSession() {
     return $this->assertAttached($this->session);
   }
 
   public function hasSession() {
     return ($this->session !== self::ATTACHABLE);
   }
 
   private function generateConduitCertificate() {
     return Filesystem::readRandomCharacters(255);
   }
 
   public function comparePassword(PhutilOpaqueEnvelope $envelope) {
     if (!strlen($envelope->openEnvelope())) {
       return false;
     }
     if (!strlen($this->getPasswordHash())) {
       return false;
     }
 
     return PhabricatorPasswordHasher::comparePassword(
       $this->getPasswordHashInput($envelope),
       new PhutilOpaqueEnvelope($this->getPasswordHash()));
   }
 
   private function getPasswordHashInput(PhutilOpaqueEnvelope $password) {
     $input =
       $this->getUsername().
       $password->openEnvelope().
       $this->getPHID().
       $this->getPasswordSalt();
 
     return new PhutilOpaqueEnvelope($input);
   }
 
   private function hashPassword(PhutilOpaqueEnvelope $password) {
     $hasher = PhabricatorPasswordHasher::getBestHasher();
 
     $input_envelope = $this->getPasswordHashInput($password);
     return $hasher->getPasswordHashForStorage($input_envelope);
   }
 
   const CSRF_CYCLE_FREQUENCY  = 3600;
   const CSRF_SALT_LENGTH      = 8;
   const CSRF_TOKEN_LENGTH     = 16;
   const CSRF_BREACH_PREFIX    = 'B@';
 
   const EMAIL_CYCLE_FREQUENCY = 86400;
   const EMAIL_TOKEN_LENGTH    = 24;
 
   private function getRawCSRFToken($offset = 0) {
     return $this->generateToken(
       time() + (self::CSRF_CYCLE_FREQUENCY * $offset),
       self::CSRF_CYCLE_FREQUENCY,
       PhabricatorEnv::getEnvConfig('phabricator.csrf-key'),
       self::CSRF_TOKEN_LENGTH);
   }
 
   public function getCSRFToken() {
     if ($this->isOmnipotent()) {
       // We may end up here when called from the daemons. The omnipotent user
       // has no meaningful CSRF token, so just return `null`.
       return null;
     }
 
     if ($this->csrfSalt === null) {
       $this->csrfSalt = Filesystem::readRandomCharacters(
         self::CSRF_SALT_LENGTH);
     }
 
     $salt = $this->csrfSalt;
 
     // Generate a token hash to mitigate BREACH attacks against SSL. See
     // discussion in T3684.
     $token = $this->getRawCSRFToken();
     $hash = PhabricatorHash::digest($token, $salt);
     return self::CSRF_BREACH_PREFIX.$salt.substr(
         $hash, 0, self::CSRF_TOKEN_LENGTH);
   }
 
   public function validateCSRFToken($token) {
-    $salt = null;
-    $version = 'plain';
-
-    // This is a BREACH-mitigating token. See T3684.
+    // We expect a BREACH-mitigating token. See T3684.
     $breach_prefix = self::CSRF_BREACH_PREFIX;
     $breach_prelen = strlen($breach_prefix);
-
-    if (!strncmp($token, $breach_prefix, $breach_prelen)) {
-      $version = 'breach';
-      $salt = substr($token, $breach_prelen, self::CSRF_SALT_LENGTH);
-      $token = substr($token, $breach_prelen + self::CSRF_SALT_LENGTH);
+    if (strncmp($token, $breach_prefix, $breach_prelen) !== 0) {
+      return false;
     }
 
+    $salt = substr($token, $breach_prelen, self::CSRF_SALT_LENGTH);
+    $token = substr($token, $breach_prelen + self::CSRF_SALT_LENGTH);
+
     // When the user posts a form, we check that it contains a valid CSRF token.
     // Tokens cycle each hour (every CSRF_CYLCE_FREQUENCY seconds) and we accept
     // either the current token, the next token (users can submit a "future"
     // token if you have two web frontends that have some clock skew) or any of
     // the last 6 tokens. This means that pages are valid for up to 7 hours.
     // There is also some Javascript which periodically refreshes the CSRF
     // tokens on each page, so theoretically pages should be valid indefinitely.
     // However, this code may fail to run (if the user loses their internet
     // connection, or there's a JS problem, or they don't have JS enabled).
     // Choosing the size of the window in which we accept old CSRF tokens is
     // an issue of balancing concerns between security and usability. We could
     // choose a very narrow (e.g., 1-hour) window to reduce vulnerability to
     // attacks using captured CSRF tokens, but it's also more likely that real
     // users will be affected by this, e.g. if they close their laptop for an
     // hour, open it back up, and try to submit a form before the CSRF refresh
     // can kick in. Since the user experience of submitting a form with expired
     // CSRF is often quite bad (you basically lose data, or it's a big pain to
     // recover at least) and I believe we gain little additional protection
     // by keeping the window very short (the overwhelming value here is in
     // preventing blind attacks, and most attacks which can capture CSRF tokens
     // can also just capture authentication information [sniffing networks]
     // or act as the user [xss]) the 7 hour default seems like a reasonable
     // balance. Other major platforms have much longer CSRF token lifetimes,
     // like Rails (session duration) and Django (forever), which suggests this
     // is a reasonable analysis.
     $csrf_window = 6;
 
     for ($ii = -$csrf_window; $ii <= 1; $ii++) {
       $valid = $this->getRawCSRFToken($ii);
-      switch ($version) {
-        // TODO: We can remove this after the BREACH version has been in the
-        // wild for a while.
-        case 'plain':
-          if ($token == $valid) {
-            return true;
-          }
-          break;
-        case 'breach':
-          $digest = PhabricatorHash::digest($valid, $salt);
-          if (substr($digest, 0, self::CSRF_TOKEN_LENGTH) == $token) {
-            return true;
-          }
-          break;
-        default:
-          throw new Exception(pht('Unknown CSRF token format!'));
+
+      $digest = PhabricatorHash::digest($valid, $salt);
+      $digest = substr($digest, 0, self::CSRF_TOKEN_LENGTH);
+      if (phutil_hashes_are_identical($digest, $token)) {
+        return true;
       }
     }
 
     return false;
   }
 
   private function generateToken($epoch, $frequency, $key, $len) {
     if ($this->getPHID()) {
       $vec = $this->getPHID().$this->getAccountSecret();
     } else {
       $vec = $this->getAlternateCSRFString();
     }
 
     if ($this->hasSession()) {
       $vec = $vec.$this->getSession()->getSessionKey();
     }
 
     $time_block = floor($epoch / $frequency);
     $vec = $vec.$key.$time_block;
 
     return substr(PhabricatorHash::digest($vec), 0, $len);
   }
 
   public function getUserProfile() {
     return $this->assertAttached($this->profile);
   }
 
   public function attachUserProfile(PhabricatorUserProfile $profile) {
     $this->profile = $profile;
     return $this;
   }
 
   public function loadUserProfile() {
     if ($this->profile) {
       return $this->profile;
     }
 
     $profile_dao = new PhabricatorUserProfile();
     $this->profile = $profile_dao->loadOneWhere('userPHID = %s',
       $this->getPHID());
 
     if (!$this->profile) {
       $profile_dao->setUserPHID($this->getPHID());
       $this->profile = $profile_dao;
     }
 
     return $this->profile;
   }
 
   public function loadPrimaryEmailAddress() {
     $email = $this->loadPrimaryEmail();
     if (!$email) {
       throw new Exception(pht('User has no primary email address!'));
     }
     return $email->getAddress();
   }
 
   public function loadPrimaryEmail() {
     return $this->loadOneRelative(
       new PhabricatorUserEmail(),
       'userPHID',
       'getPHID',
       '(isPrimary = 1)');
   }
 
   public function loadPreferences() {
     if ($this->preferences) {
       return $this->preferences;
     }
 
     $preferences = null;
     if ($this->getPHID()) {
       $preferences = id(new PhabricatorUserPreferences())->loadOneWhere(
         'userPHID = %s',
         $this->getPHID());
     }
 
     if (!$preferences) {
       $preferences = new PhabricatorUserPreferences();
       $preferences->setUserPHID($this->getPHID());
 
       $default_dict = array(
         PhabricatorUserPreferences::PREFERENCE_TITLES => 'glyph',
         PhabricatorUserPreferences::PREFERENCE_EDITOR => '',
         PhabricatorUserPreferences::PREFERENCE_MONOSPACED => '',
         PhabricatorUserPreferences::PREFERENCE_DARK_CONSOLE => 0,
       );
 
       $preferences->setPreferences($default_dict);
     }
 
     $this->preferences = $preferences;
     return $preferences;
   }
 
   public function loadEditorLink($path, $line, $callsign) {
     $editor = $this->loadPreferences()->getPreference(
       PhabricatorUserPreferences::PREFERENCE_EDITOR);
 
     if (is_array($path)) {
       $multiedit = $this->loadPreferences()->getPreference(
         PhabricatorUserPreferences::PREFERENCE_MULTIEDIT);
       switch ($multiedit) {
         case '':
           $path = implode(' ', $path);
           break;
         case 'disable':
           return null;
       }
     }
 
     if (!strlen($editor)) {
       return null;
     }
 
     $uri = strtr($editor, array(
       '%%' => '%',
       '%f' => phutil_escape_uri($path),
       '%l' => phutil_escape_uri($line),
       '%r' => phutil_escape_uri($callsign),
     ));
 
     // The resulting URI must have an allowed protocol. Otherwise, we'll return
     // a link to an error page explaining the misconfiguration.
 
     $ok = PhabricatorHelpEditorProtocolController::hasAllowedProtocol($uri);
     if (!$ok) {
       return '/help/editorprotocol/';
     }
 
     return (string)$uri;
   }
 
   public function getAlternateCSRFString() {
     return $this->assertAttached($this->alternateCSRFString);
   }
 
   public function attachAlternateCSRFString($string) {
     $this->alternateCSRFString = $string;
     return $this;
   }
 
   /**
    * Populate the nametoken table, which used to fetch typeahead results. When
    * a user types "linc", we want to match "Abraham Lincoln" from on-demand
    * typeahead sources. To do this, we need a separate table of name fragments.
    */
   public function updateNameTokens() {
     $table  = self::NAMETOKEN_TABLE;
     $conn_w = $this->establishConnection('w');
 
     $tokens = PhabricatorTypeaheadDatasource::tokenizeString(
       $this->getUserName().' '.$this->getRealName());
 
     $sql = array();
     foreach ($tokens as $token) {
       $sql[] = qsprintf(
         $conn_w,
         '(%d, %s)',
         $this->getID(),
         $token);
     }
 
     queryfx(
       $conn_w,
       'DELETE FROM %T WHERE userID = %d',
       $table,
       $this->getID());
     if ($sql) {
       queryfx(
         $conn_w,
         'INSERT INTO %T (userID, token) VALUES %Q',
         $table,
         implode(', ', $sql));
     }
   }
 
   public function sendWelcomeEmail(PhabricatorUser $admin) {
     $admin_username = $admin->getUserName();
     $admin_realname = $admin->getRealName();
     $user_username = $this->getUserName();
     $is_serious = PhabricatorEnv::getEnvConfig('phabricator.serious-business');
 
     $base_uri = PhabricatorEnv::getProductionURI('/');
 
     $engine = new PhabricatorAuthSessionEngine();
     $uri = $engine->getOneTimeLoginURI(
       $this,
       $this->loadPrimaryEmail(),
       PhabricatorAuthSessionEngine::ONETIME_WELCOME);
 
     $body = pht(
       "Welcome to Phabricator!\n\n".
       "%s (%s) has created an account for you.\n\n".
       "  Username: %s\n\n".
       "To login to Phabricator, follow this link and set a password:\n\n".
       "  %s\n\n".
       "After you have set a password, you can login in the future by ".
       "going here:\n\n".
       "  %s\n",
       $admin_username,
       $admin_realname,
       $user_username,
       $uri,
       $base_uri);
 
     if (!$is_serious) {
       $body .= sprintf(
         "\n%s\n",
         pht("Love,\nPhabricator"));
     }
 
     $mail = id(new PhabricatorMetaMTAMail())
       ->addTos(array($this->getPHID()))
       ->setForceDelivery(true)
       ->setSubject(pht('[Phabricator] Welcome to Phabricator'))
       ->setBody($body)
       ->saveAndSend();
   }
 
   public function sendUsernameChangeEmail(
     PhabricatorUser $admin,
     $old_username) {
 
     $admin_username = $admin->getUserName();
     $admin_realname = $admin->getRealName();
     $new_username = $this->getUserName();
 
     $password_instructions = null;
     if (PhabricatorPasswordAuthProvider::getPasswordProvider()) {
       $engine = new PhabricatorAuthSessionEngine();
       $uri = $engine->getOneTimeLoginURI(
         $this,
         null,
         PhabricatorAuthSessionEngine::ONETIME_USERNAME);
       $password_instructions = sprintf(
         "%s\n\n  %s\n\n%s\n",
         pht(
           "If you use a password to login, you'll need to reset it ".
           "before you can login again. You can reset your password by ".
           "following this link:"),
         $uri,
         pht(
           "And, of course, you'll need to use your new username to login ".
           "from now on. If you use OAuth to login, nothing should change."));
     }
 
     $body = sprintf(
       "%s\n\n  %s\n  %s\n\n%s",
       pht(
         '%s (%s) has changed your Phabricator username.',
         $admin_username,
         $admin_realname),
       pht(
         'Old Username: %s',
         $old_username),
       pht(
         'New Username: %s',
         $new_username),
       $password_instructions);
 
     $mail = id(new PhabricatorMetaMTAMail())
       ->addTos(array($this->getPHID()))
       ->setForceDelivery(true)
       ->setSubject(pht('[Phabricator] Username Changed'))
       ->setBody($body)
       ->saveAndSend();
   }
 
   public static function describeValidUsername() {
     return pht(
       'Usernames must contain only numbers, letters, period, underscore and '.
       'hyphen, and can not end with a period. They must have no more than %d '.
       'characters.',
       new PhutilNumber(self::MAXIMUM_USERNAME_LENGTH));
   }
 
   public static function validateUsername($username) {
     // NOTE: If you update this, make sure to update:
     //
     //  - Remarkup rule for @mentions.
     //  - Routing rule for "/p/username/".
     //  - Unit tests, obviously.
     //  - describeValidUsername() method, above.
 
     if (strlen($username) > self::MAXIMUM_USERNAME_LENGTH) {
       return false;
     }
 
     return (bool)preg_match('/^[a-zA-Z0-9._-]*[a-zA-Z0-9_-]\z/', $username);
   }
 
   public static function getDefaultProfileImageURI() {
     return celerity_get_resource_uri('/rsrc/image/avatar.png');
   }
 
   public function attachProfileImageURI($uri) {
     $this->profileImage = $uri;
     return $this;
   }
 
   public function getProfileImageURI() {
     return $this->assertAttached($this->profileImage);
   }
 
   public function getFullName() {
     if (strlen($this->getRealName())) {
       return $this->getUsername().' ('.$this->getRealName().')';
     } else {
       return $this->getUsername();
     }
   }
 
   public function getTimeZone() {
     return new DateTimeZone($this->getTimezoneIdentifier());
   }
 
   public function getPreference($key) {
     $preferences = $this->loadPreferences();
 
     // TODO: After T4103 and T7707 this should eventually be pushed down the
     // stack into modular preference definitions and role profiles. This is
     // just fixing T8601 and mildly anticipating those changes.
     $value = $preferences->getPreference($key);
 
     $allowed_values = null;
     switch ($key) {
       case PhabricatorUserPreferences::PREFERENCE_TIME_FORMAT:
         $allowed_values = array(
           'g:i A',
           'H:i',
         );
         break;
       case PhabricatorUserPreferences::PREFERENCE_DATE_FORMAT:
         $allowed_values = array(
           'Y-m-d',
           'n/j/Y',
           'd-m-Y',
         );
         break;
     }
 
     if ($allowed_values !== null) {
       $allowed_values = array_fuse($allowed_values);
       if (empty($allowed_values[$value])) {
         $value = head($allowed_values);
       }
     }
 
     return $value;
   }
 
   public function __toString() {
     return $this->getUsername();
   }
 
   public static function loadOneWithEmailAddress($address) {
     $email = id(new PhabricatorUserEmail())->loadOneWhere(
       'address = %s',
       $address);
     if (!$email) {
       return null;
     }
     return id(new PhabricatorUser())->loadOneWhere(
       'phid = %s',
       $email->getUserPHID());
   }
 
   public function getDefaultSpacePHID() {
     // TODO: We might let the user switch which space they're "in" later on;
     // for now just use the global space if one exists.
 
     // If the viewer has access to the default space, use that.
     $spaces = PhabricatorSpacesNamespaceQuery::getViewerActiveSpaces($this);
     foreach ($spaces as $space) {
       if ($space->getIsDefaultNamespace()) {
         return $space->getPHID();
       }
     }
 
     // Otherwise, use the space with the lowest ID that they have access to.
     // This just tends to keep the default stable and predictable over time,
     // so adding a new space won't change behavior for users.
     if ($spaces) {
       $spaces = msort($spaces, 'getID');
       return head($spaces)->getPHID();
     }
 
     return null;
   }
 
 
   /**
    * Grant a user a source of authority, to let them bypass policy checks they
    * could not otherwise.
    */
   public function grantAuthority($authority) {
     $this->authorities[] = $authority;
     return $this;
   }
 
 
   /**
    * Get authorities granted to the user.
    */
   public function getAuthorities() {
     return $this->authorities;
   }
 
 
 /* -(  Availability  )------------------------------------------------------- */
 
 
   /**
    * @task availability
    */
   public function attachAvailability(array $availability) {
     $this->availability = $availability;
     return $this;
   }
 
 
   /**
    * Get the timestamp the user is away until, if they are currently away.
    *
    * @return int|null Epoch timestamp, or `null` if the user is not away.
    * @task availability
    */
   public function getAwayUntil() {
     $availability = $this->availability;
 
     $this->assertAttached($availability);
     if (!$availability) {
       return null;
     }
 
     return idx($availability, 'until');
   }
 
 
   /**
    * Describe the user's availability.
    *
    * @param PhabricatorUser Viewing user.
    * @return string Human-readable description of away status.
    * @task availability
    */
   public function getAvailabilityDescription(PhabricatorUser $viewer) {
     $until = $this->getAwayUntil();
     if ($until) {
       return pht('Away until %s', phabricator_datetime($until, $viewer));
     } else {
       return pht('Available');
     }
   }
 
 
   /**
    * Get cached availability, if present.
    *
    * @return wild|null Cache data, or null if no cache is available.
    * @task availability
    */
   public function getAvailabilityCache() {
     $now = PhabricatorTime::getNow();
     if ($this->availabilityCacheTTL <= $now) {
       return null;
     }
 
     try {
       return phutil_json_decode($this->availabilityCache);
     } catch (Exception $ex) {
       return null;
     }
   }
 
 
   /**
    * Write to the availability cache.
    *
    * @param wild Availability cache data.
    * @param int|null Cache TTL.
    * @return this
    * @task availability
    */
   public function writeAvailabilityCache(array $availability, $ttl) {
     $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
     queryfx(
       $this->establishConnection('w'),
       'UPDATE %T SET availabilityCache = %s, availabilityCacheTTL = %nd
         WHERE id = %d',
       $this->getTableName(),
       json_encode($availability),
       $ttl,
       $this->getID());
     unset($unguarded);
 
     return $this;
   }
 
 
 /* -(  Profile Image Cache  )------------------------------------------------ */
 
 
   /**
    * Get this user's cached profile image URI.
    *
    * @return string|null Cached URI, if a URI is cached.
    * @task image-cache
    */
   public function getProfileImageCache() {
     $version = $this->getProfileImageVersion();
 
     $parts = explode(',', $this->profileImageCache, 2);
     if (count($parts) !== 2) {
       return null;
     }
 
     if ($parts[0] !== $version) {
       return null;
     }
 
     return $parts[1];
   }
 
 
   /**
    * Generate a new cache value for this user's profile image.
    *
    * @return string New cache value.
    * @task image-cache
    */
   public function writeProfileImageCache($uri) {
     $version = $this->getProfileImageVersion();
     $cache = "{$version},{$uri}";
 
     $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
     queryfx(
       $this->establishConnection('w'),
       'UPDATE %T SET profileImageCache = %s WHERE id = %d',
       $this->getTableName(),
       $cache,
       $this->getID());
     unset($unguarded);
   }
 
 
   /**
    * Get a version identifier for a user's profile image.
    *
    * This version will change if the image changes, or if any of the
    * environment configuration which goes into generating a URI changes.
    *
    * @return string Cache version.
    * @task image-cache
    */
   private function getProfileImageVersion() {
     $parts = array(
       PhabricatorEnv::getCDNURI('/'),
       PhabricatorEnv::getEnvConfig('cluster.instance'),
       $this->getProfileImagePHID(),
     );
     $parts = serialize($parts);
     return PhabricatorHash::digestForIndex($parts);
   }
 
 
 /* -(  Multi-Factor Authentication  )---------------------------------------- */
 
 
   /**
    * Update the flag storing this user's enrollment in multi-factor auth.
    *
    * With certain settings, we need to check if a user has MFA on every page,
    * so we cache MFA enrollment on the user object for performance. Calling this
    * method synchronizes the cache by examining enrollment records. After
    * updating the cache, use @{method:getIsEnrolledInMultiFactor} to check if
    * the user is enrolled.
    *
    * This method should be called after any changes are made to a given user's
    * multi-factor configuration.
    *
    * @return void
    * @task factors
    */
   public function updateMultiFactorEnrollment() {
     $factors = id(new PhabricatorAuthFactorConfig())->loadAllWhere(
       'userPHID = %s',
       $this->getPHID());
 
     $enrolled = count($factors) ? 1 : 0;
     if ($enrolled !== $this->isEnrolledInMultiFactor) {
       $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
         queryfx(
           $this->establishConnection('w'),
           'UPDATE %T SET isEnrolledInMultiFactor = %d WHERE id = %d',
           $this->getTableName(),
           $enrolled,
           $this->getID());
       unset($unguarded);
 
       $this->isEnrolledInMultiFactor = $enrolled;
     }
   }
 
 
   /**
    * Check if the user is enrolled in multi-factor authentication.
    *
    * Enrolled users have one or more multi-factor authentication sources
    * attached to their account. For performance, this value is cached. You
    * can use @{method:updateMultiFactorEnrollment} to update the cache.
    *
    * @return bool True if the user is enrolled.
    * @task factors
    */
   public function getIsEnrolledInMultiFactor() {
     return $this->isEnrolledInMultiFactor;
   }
 
 
 /* -(  Omnipotence  )-------------------------------------------------------- */
 
 
   /**
    * Returns true if this user is omnipotent. Omnipotent users bypass all policy
    * checks.
    *
    * @return bool True if the user bypasses policy checks.
    */
   public function isOmnipotent() {
     return $this->omnipotent;
   }
 
 
   /**
    * Get an omnipotent user object for use in contexts where there is no acting
    * user, notably daemons.
    *
    * @return PhabricatorUser An omnipotent user.
    */
   public static function getOmnipotentUser() {
     static $user = null;
     if (!$user) {
       $user = new PhabricatorUser();
       $user->omnipotent = true;
       $user->makeEphemeral();
     }
     return $user;
   }
 
 
   /**
    * Get a scalar string identifying this user.
    *
    * This is similar to using the PHID, but distinguishes between ominpotent
    * and public users explicitly. This allows safe construction of cache keys
    * or cache buckets which do not conflate public and omnipotent users.
    *
    * @return string Scalar identifier.
    */
   public function getCacheFragment() {
     if ($this->isOmnipotent()) {
       return 'u.omnipotent';
     }
 
     $phid = $this->getPHID();
     if ($phid) {
       return 'u.'.$phid;
     }
 
     return 'u.public';
   }
 
 
 /* -(  Managing Handles  )--------------------------------------------------- */
 
 
   /**
    * Get a @{class:PhabricatorHandleList} which benefits from this viewer's
    * internal handle pool.
    *
    * @param list<phid> List of PHIDs to load.
    * @return PhabricatorHandleList Handle list object.
    * @task handle
    */
   public function loadHandles(array $phids) {
     if ($this->handlePool === null) {
       $this->handlePool = id(new PhabricatorHandlePool())
         ->setViewer($this);
     }
 
     return $this->handlePool->newHandleList($phids);
   }
 
 
   /**
    * Get a @{class:PHUIHandleView} for a single handle.
    *
    * This benefits from the viewer's internal handle pool.
    *
    * @param phid PHID to render a handle for.
    * @return PHUIHandleView View of the handle.
    * @task handle
    */
   public function renderHandle($phid) {
     return $this->loadHandles(array($phid))->renderHandle($phid);
   }
 
 
   /**
    * Get a @{class:PHUIHandleListView} for a list of handles.
    *
    * This benefits from the viewer's internal handle pool.
    *
    * @param list<phid> List of PHIDs to render.
    * @return PHUIHandleListView View of the handles.
    * @task handle
    */
   public function renderHandleList(array $phids) {
     return $this->loadHandles($phids)->renderList();
   }
 
   public function attachBadgePHIDs(array $phids) {
     $this->badgePHIDs = $phids;
     return $this;
   }
 
   public function getBadgePHIDs() {
     return $this->assertAttached($this->badgePHIDs);
   }
 
 
 /* -(  PhabricatorPolicyInterface  )----------------------------------------- */
 
 
   public function getCapabilities() {
     return array(
       PhabricatorPolicyCapability::CAN_VIEW,
       PhabricatorPolicyCapability::CAN_EDIT,
     );
   }
 
   public function getPolicy($capability) {
     switch ($capability) {
       case PhabricatorPolicyCapability::CAN_VIEW:
         return PhabricatorPolicies::POLICY_PUBLIC;
       case PhabricatorPolicyCapability::CAN_EDIT:
         if ($this->getIsSystemAgent() || $this->getIsMailingList()) {
           return PhabricatorPolicies::POLICY_ADMIN;
         } else {
           return PhabricatorPolicies::POLICY_NOONE;
         }
     }
   }
 
   public function hasAutomaticCapability($capability, PhabricatorUser $viewer) {
     return $this->getPHID() && ($viewer->getPHID() === $this->getPHID());
   }
 
   public function describeAutomaticCapability($capability) {
     switch ($capability) {
       case PhabricatorPolicyCapability::CAN_EDIT:
         return pht('Only you can edit your information.');
       default:
         return null;
     }
   }
 
 
 /* -(  PhabricatorCustomFieldInterface  )------------------------------------ */
 
 
   public function getCustomFieldSpecificationForRole($role) {
     return PhabricatorEnv::getEnvConfig('user.fields');
   }
 
   public function getCustomFieldBaseClass() {
     return 'PhabricatorUserCustomField';
   }
 
   public function getCustomFields() {
     return $this->assertAttached($this->customFields);
   }
 
   public function attachCustomFields(PhabricatorCustomFieldAttachment $fields) {
     $this->customFields = $fields;
     return $this;
   }
 
 
 /* -(  PhabricatorDestructibleInterface  )----------------------------------- */
 
 
   public function destroyObjectPermanently(
     PhabricatorDestructionEngine $engine) {
 
     $this->openTransaction();
       $this->delete();
 
       $externals = id(new PhabricatorExternalAccount())->loadAllWhere(
         'userPHID = %s',
         $this->getPHID());
       foreach ($externals as $external) {
         $external->delete();
       }
 
       $prefs = id(new PhabricatorUserPreferences())->loadAllWhere(
         'userPHID = %s',
         $this->getPHID());
       foreach ($prefs as $pref) {
         $pref->delete();
       }
 
       $profiles = id(new PhabricatorUserProfile())->loadAllWhere(
         'userPHID = %s',
         $this->getPHID());
       foreach ($profiles as $profile) {
         $profile->delete();
       }
 
       $keys = id(new PhabricatorAuthSSHKey())->loadAllWhere(
         'objectPHID = %s',
         $this->getPHID());
       foreach ($keys as $key) {
         $key->delete();
       }
 
       $emails = id(new PhabricatorUserEmail())->loadAllWhere(
         'userPHID = %s',
         $this->getPHID());
       foreach ($emails as $email) {
         $email->delete();
       }
 
       $sessions = id(new PhabricatorAuthSession())->loadAllWhere(
         'userPHID = %s',
         $this->getPHID());
       foreach ($sessions as $session) {
         $session->delete();
       }
 
       $factors = id(new PhabricatorAuthFactorConfig())->loadAllWhere(
         'userPHID = %s',
         $this->getPHID());
       foreach ($factors as $factor) {
         $factor->delete();
       }
 
     $this->saveTransaction();
   }
 
 
 /* -(  PhabricatorSSHPublicKeyInterface  )----------------------------------- */
 
 
   public function getSSHPublicKeyManagementURI(PhabricatorUser $viewer) {
     if ($viewer->getPHID() == $this->getPHID()) {
       // If the viewer is managing their own keys, take them to the normal
       // panel.
       return '/settings/panel/ssh/';
     } else {
       // Otherwise, take them to the administrative panel for this user.
       return '/settings/'.$this->getID().'/panel/ssh/';
     }
   }
 
   public function getSSHKeyDefaultName() {
     return 'id_rsa_phabricator';
   }
 
 
 /* -(  PhabricatorApplicationTransactionInterface  )------------------------- */
 
 
   public function getApplicationTransactionEditor() {
     return new PhabricatorUserProfileEditor();
   }
 
   public function getApplicationTransactionObject() {
     return $this;
   }
 
   public function getApplicationTransactionTemplate() {
     return new PhabricatorUserTransaction();
   }
 
   public function willRenderTimeline(
     PhabricatorApplicationTransactionView $timeline,
     AphrontRequest $request) {
     return $timeline;
   }
 
 }
diff --git a/src/applications/settings/panel/PhabricatorSessionsSettingsPanel.php b/src/applications/settings/panel/PhabricatorSessionsSettingsPanel.php
index b89ea8e902..8bb6653471 100644
--- a/src/applications/settings/panel/PhabricatorSessionsSettingsPanel.php
+++ b/src/applications/settings/panel/PhabricatorSessionsSettingsPanel.php
@@ -1,146 +1,149 @@
 <?php
 
 final class PhabricatorSessionsSettingsPanel extends PhabricatorSettingsPanel {
 
   public function getPanelKey() {
     return 'sessions';
   }
 
   public function getPanelName() {
     return pht('Sessions');
   }
 
   public function getPanelGroup() {
     return pht('Sessions and Logs');
   }
 
   public function isEnabled() {
     return true;
   }
 
   public function processRequest(AphrontRequest $request) {
     $viewer = $request->getUser();
 
     $accounts = id(new PhabricatorExternalAccountQuery())
       ->setViewer($viewer)
       ->withUserPHIDs(array($viewer->getPHID()))
       ->requireCapabilities(
         array(
           PhabricatorPolicyCapability::CAN_VIEW,
           PhabricatorPolicyCapability::CAN_EDIT,
         ))
       ->execute();
 
     $identity_phids = mpull($accounts, 'getPHID');
     $identity_phids[] = $viewer->getPHID();
 
     $sessions = id(new PhabricatorAuthSessionQuery())
       ->setViewer($viewer)
       ->withIdentityPHIDs($identity_phids)
       ->execute();
 
     $handles = id(new PhabricatorHandleQuery())
       ->setViewer($viewer)
       ->withPHIDs($identity_phids)
       ->execute();
 
     $current_key = PhabricatorHash::digest(
       $request->getCookie(PhabricatorCookies::COOKIE_SESSION));
 
     $rows = array();
     $rowc = array();
     foreach ($sessions as $session) {
-      if ($session->getSessionKey() == $current_key) {
+      $is_current = phutil_hashes_are_identical(
+        $session->getSessionKey(),
+        $current_key);
+      if ($is_current) {
         $rowc[] = 'highlighted';
         $button = phutil_tag(
           'a',
           array(
             'class' => 'small grey button disabled',
           ),
           pht('Current'));
       } else {
         $rowc[] = null;
         $button = javelin_tag(
           'a',
           array(
             'href' => '/auth/session/terminate/'.$session->getID().'/',
             'class' => 'small grey button',
             'sigil' => 'workflow',
           ),
           pht('Terminate'));
       }
 
       $hisec = ($session->getHighSecurityUntil() - time());
 
       $rows[] = array(
         $handles[$session->getUserPHID()]->renderLink(),
         substr($session->getSessionKey(), 0, 6),
         $session->getType(),
         ($hisec > 0)
           ? phutil_format_relative_time($hisec)
           : null,
         phabricator_datetime($session->getSessionStart(), $viewer),
         phabricator_date($session->getSessionExpires(), $viewer),
         $button,
       );
     }
 
     $table = new AphrontTableView($rows);
     $table->setNoDataString(pht("You don't have any active sessions."));
     $table->setRowClasses($rowc);
     $table->setHeaders(
       array(
         pht('Identity'),
         pht('Session'),
         pht('Type'),
         pht('HiSec'),
         pht('Created'),
         pht('Expires'),
         pht(''),
       ));
     $table->setColumnClasses(
       array(
         'wide',
         'n',
         '',
         'right',
         'right',
         'right',
         'action',
       ));
 
 
     $terminate_icon = id(new PHUIIconView())
       ->setIconFont('fa-exclamation-triangle');
     $terminate_button = id(new PHUIButtonView())
       ->setText(pht('Terminate All Sessions'))
       ->setHref('/auth/session/terminate/all/')
       ->setTag('a')
       ->setWorkflow(true)
       ->setIcon($terminate_icon);
 
     $header = id(new PHUIHeaderView())
       ->setHeader(pht('Active Login Sessions'))
       ->addActionLink($terminate_button);
 
     $hisec = ($viewer->getSession()->getHighSecurityUntil() - time());
     if ($hisec > 0) {
       $hisec_icon = id(new PHUIIconView())
         ->setIconFont('fa-lock');
       $hisec_button = id(new PHUIButtonView())
         ->setText(pht('Leave High Security'))
         ->setHref('/auth/session/downgrade/')
         ->setTag('a')
         ->setWorkflow(true)
         ->setIcon($hisec_icon);
       $header->addActionLink($hisec_button);
     }
 
     $panel = id(new PHUIObjectBoxView())
       ->setHeader($header)
       ->setTable($table);
 
     return $panel;
   }
 
 }
diff --git a/src/infrastructure/util/password/PhabricatorPasswordHasher.php b/src/infrastructure/util/password/PhabricatorPasswordHasher.php
index ef8c208b9f..b7a4c1453b 100644
--- a/src/infrastructure/util/password/PhabricatorPasswordHasher.php
+++ b/src/infrastructure/util/password/PhabricatorPasswordHasher.php
@@ -1,420 +1,420 @@
 <?php
 
 /**
  * Provides a mechanism for hashing passwords, like "iterated md5", "bcrypt",
  * "scrypt", etc.
  *
  * Hashers define suitability and strength, and the system automatically
  * chooses the strongest available hasher and can prompt users to upgrade as
  * soon as a stronger hasher is available.
  *
  * @task hasher   Implementing a Hasher
  * @task hashing  Using Hashers
  */
 abstract class PhabricatorPasswordHasher extends Phobject {
 
   const MAXIMUM_STORAGE_SIZE = 128;
 
 
 /* -(  Implementing a Hasher  )---------------------------------------------- */
 
 
   /**
    * Return a human-readable description of this hasher, like "Iterated MD5".
    *
    * @return string Human readable hash name.
    * @task hasher
    */
   abstract public function getHumanReadableName();
 
 
   /**
    * Return a short, unique, key identifying this hasher, like "md5" or
    * "bcrypt". This identifier should not be translated.
    *
    * @return string Short, unique hash name.
    * @task hasher
    */
   abstract public function getHashName();
 
 
   /**
    * Return the maximum byte length of hashes produced by this hasher. This is
    * used to prevent storage overflows.
    *
    * @return int  Maximum number of bytes in hashes this class produces.
    * @task hasher
    */
   abstract public function getHashLength();
 
 
   /**
    * Return `true` to indicate that any required extensions or dependencies
    * are available, and this hasher is able to perform hashing.
    *
    * @return bool True if this hasher can execute.
    * @task hasher
    */
   abstract public function canHashPasswords();
 
 
   /**
    * Return a human-readable string describing why this hasher is unable
    * to operate. For example, "To use bcrypt, upgrade to PHP 5.5.0 or newer.".
    *
    * @return string Human-readable description of how to enable this hasher.
    * @task hasher
    */
   abstract public function getInstallInstructions();
 
 
   /**
    * Return an indicator of this hasher's strength. When choosing to hash
    * new passwords, the strongest available hasher which is usuable for new
    * passwords will be used, and the presence of a stronger hasher will
    * prompt users to update their hashes.
    *
    * Generally, this method should return a larger number than hashers it is
    * preferable to, but a smaller number than hashers which are better than it
    * is. This number does not need to correspond directly with the actual hash
    * strength.
    *
    * @return float  Strength of this hasher.
    * @task hasher
    */
   abstract public function getStrength();
 
 
   /**
    * Return a short human-readable indicator of this hasher's strength, like
    * "Weak", "Okay", or "Good".
    *
    * This is only used to help administrators make decisions about
    * configuration.
    *
    * @return string Short human-readable description of hash strength.
    * @task hasher
    */
   abstract public function getHumanReadableStrength();
 
 
   /**
    * Produce a password hash.
    *
    * @param   PhutilOpaqueEnvelope  Text to be hashed.
    * @return  PhutilOpaqueEnvelope  Hashed text.
    * @task hasher
    */
   abstract protected function getPasswordHash(PhutilOpaqueEnvelope $envelope);
 
 
   /**
    * Verify that a password matches a hash.
    *
    * The default implementation checks for equality; if a hasher embeds salt in
    * hashes it should override this method and perform a salt-aware comparison.
    *
    * @param   PhutilOpaqueEnvelope  Password to compare.
    * @param   PhutilOpaqueEnvelope  Bare password hash.
    * @return  bool                  True if the passwords match.
    * @task hasher
    */
   protected function verifyPassword(
     PhutilOpaqueEnvelope $password,
     PhutilOpaqueEnvelope $hash) {
 
     $actual_hash = $this->getPasswordHash($password)->openEnvelope();
     $expect_hash = $hash->openEnvelope();
 
-    return ($actual_hash === $expect_hash);
+    return phutil_hashes_are_identical($actual_hash, $expect_hash);
   }
 
 
   /**
    * Check if an existing hash created by this algorithm is upgradeable.
    *
    * The default implementation returns `false`. However, hash algorithms which
    * have (for example) an internal cost function may be able to upgrade an
    * existing hash to a stronger one with a higher cost.
    *
    * @param PhutilOpaqueEnvelope  Bare hash.
    * @return bool                 True if the hash can be upgraded without
    *                              changing the algorithm (for example, to a
    *                              higher cost).
    * @task hasher
    */
   protected function canUpgradeInternalHash(PhutilOpaqueEnvelope $hash) {
     return false;
   }
 
 
 /* -(  Using Hashers  )------------------------------------------------------ */
 
 
   /**
    * Get the hash of a password for storage.
    *
    * @param   PhutilOpaqueEnvelope  Password text.
    * @return  PhutilOpaqueEnvelope  Hashed text.
    * @task hashing
    */
   final public function getPasswordHashForStorage(
     PhutilOpaqueEnvelope $envelope) {
 
     $name = $this->getHashName();
     $hash = $this->getPasswordHash($envelope);
 
     $actual_len = strlen($hash->openEnvelope());
     $expect_len = $this->getHashLength();
     if ($actual_len > $expect_len) {
       throw new Exception(
         pht(
           "Password hash '%s' produced a hash of length %d, but a ".
           "maximum length of %d was expected.",
           $name,
           new PhutilNumber($actual_len),
           new PhutilNumber($expect_len)));
     }
 
     return new PhutilOpaqueEnvelope($name.':'.$hash->openEnvelope());
   }
 
 
   /**
    * Parse a storage hash into its components, like the hash type and hash
    * data.
    *
    * @return map  Dictionary of information about the hash.
    * @task hashing
    */
   private static function parseHashFromStorage(PhutilOpaqueEnvelope $hash) {
     $raw_hash = $hash->openEnvelope();
     if (strpos($raw_hash, ':') === false) {
       throw new Exception(
         pht(
           'Malformed password hash, expected "name:hash".'));
     }
 
     list($name, $hash) = explode(':', $raw_hash);
 
     return array(
       'name' => $name,
       'hash' => new PhutilOpaqueEnvelope($hash),
     );
   }
 
 
   /**
    * Get all available password hashers. This may include hashers which can not
    * actually be used (for example, a required extension is missing).
    *
    * @return list<PhabicatorPasswordHasher> Hasher objects.
    * @task hashing
    */
   public static function getAllHashers() {
     $objects = id(new PhutilClassMapQuery())
       ->setAncestorClass(__CLASS__)
       ->setUniqueMethod('getHashName')
       ->execute();
 
     foreach ($objects as $object) {
       $name = $object->getHashName();
 
       $potential_length = strlen($name) + $object->getHashLength() + 1;
       $maximum_length = self::MAXIMUM_STORAGE_SIZE;
 
       if ($potential_length > $maximum_length) {
         throw new Exception(
           pht(
             'Hasher "%s" may produce hashes which are too long to fit in '.
             'storage. %d characters are available, but its hashes may be '.
             'up to %d characters in length.',
             $name,
             $maximum_length,
             $potential_length));
       }
     }
 
     return $objects;
   }
 
 
   /**
    * Get all usable password hashers. This may include hashers which are
    * not desirable or advisable.
    *
    * @return list<PhabicatorPasswordHasher> Hasher objects.
    * @task hashing
    */
   public static function getAllUsableHashers() {
     $hashers = self::getAllHashers();
     foreach ($hashers as $key => $hasher) {
       if (!$hasher->canHashPasswords()) {
         unset($hashers[$key]);
       }
     }
     return $hashers;
   }
 
 
   /**
    * Get the best (strongest) available hasher.
    *
    * @return PhabicatorPasswordHasher Best hasher.
    * @task hashing
    */
   public static function getBestHasher() {
     $hashers = self::getAllUsableHashers();
     $hashers = msort($hashers, 'getStrength');
 
     $hasher = last($hashers);
     if (!$hasher) {
       throw new PhabricatorPasswordHasherUnavailableException(
         pht(
           'There are no password hashers available which are usable for '.
           'new passwords.'));
     }
 
     return $hasher;
   }
 
 
   /**
    * Get the hashser for a given stored hash.
    *
    * @return PhabicatorPasswordHasher Corresponding hasher.
    * @task hashing
    */
   public static function getHasherForHash(PhutilOpaqueEnvelope $hash) {
     $info = self::parseHashFromStorage($hash);
     $name = $info['name'];
 
     $usable = self::getAllUsableHashers();
     if (isset($usable[$name])) {
       return $usable[$name];
     }
 
     $all = self::getAllHashers();
     if (isset($all[$name])) {
       throw new PhabricatorPasswordHasherUnavailableException(
         pht(
           'Attempting to compare a password saved with the "%s" hash. The '.
           'hasher exists, but is not currently usable. %s',
           $name,
           $all[$name]->getInstallInstructions()));
     }
 
     throw new PhabricatorPasswordHasherUnavailableException(
       pht(
         'Attempting to compare a password saved with the "%s" hash. No such '.
         'hasher is known to Phabricator.',
         $name));
   }
 
 
   /**
    * Test if a password is using an weaker hash than the strongest available
    * hash. This can be used to prompt users to upgrade, or automatically upgrade
    * on login.
    *
    * @return bool True to indicate that rehashing this password will improve
    *              the hash strength.
    * @task hashing
    */
   public static function canUpgradeHash(PhutilOpaqueEnvelope $hash) {
     if (!strlen($hash->openEnvelope())) {
       throw new Exception(
         pht('Expected a password hash, received nothing!'));
     }
 
     $current_hasher = self::getHasherForHash($hash);
     $best_hasher = self::getBestHasher();
 
     if ($current_hasher->getHashName() != $best_hasher->getHashName()) {
       // If the algorithm isn't the best one, we can upgrade.
       return true;
     }
 
     $info = self::parseHashFromStorage($hash);
     if ($current_hasher->canUpgradeInternalHash($info['hash'])) {
       // If the algorithm provides an internal upgrade, we can also upgrade.
       return true;
     }
 
     // Already on the best algorithm with the best settings.
     return false;
   }
 
 
   /**
    * Generate a new hash for a password, using the best available hasher.
    *
    * @param   PhutilOpaqueEnvelope  Password to hash.
    * @return  PhutilOpaqueEnvelope  Hashed password, using best available
    *                                hasher.
    * @task hashing
    */
   public static function generateNewPasswordHash(
     PhutilOpaqueEnvelope $password) {
     $hasher = self::getBestHasher();
     return $hasher->getPasswordHashForStorage($password);
   }
 
 
   /**
    * Compare a password to a stored hash.
    *
    * @param   PhutilOpaqueEnvelope  Password to compare.
    * @param   PhutilOpaqueEnvelope  Stored password hash.
    * @return  bool                  True if the passwords match.
    * @task hashing
    */
   public static function comparePassword(
     PhutilOpaqueEnvelope $password,
     PhutilOpaqueEnvelope $hash) {
 
     $hasher = self::getHasherForHash($hash);
     $parts = self::parseHashFromStorage($hash);
 
     return $hasher->verifyPassword($password, $parts['hash']);
   }
 
 
   /**
    * Get the human-readable algorithm name for a given hash.
    *
    * @param   PhutilOpaqueEnvelope  Storage hash.
    * @return  string                Human-readable algorithm name.
    */
   public static function getCurrentAlgorithmName(PhutilOpaqueEnvelope $hash) {
     $raw_hash = $hash->openEnvelope();
     if (!strlen($raw_hash)) {
       return pht('None');
     }
 
     try {
       $current_hasher = self::getHasherForHash($hash);
       return $current_hasher->getHumanReadableName();
     } catch (Exception $ex) {
       $info = self::parseHashFromStorage($hash);
       $name = $info['name'];
       return pht('Unknown ("%s")', $name);
     }
   }
 
 
   /**
    * Get the human-readable algorithm name for the best available hash.
    *
    * @return  string                Human-readable name for best hash.
    */
   public static function getBestAlgorithmName() {
     try {
       $best_hasher = self::getBestHasher();
       return $best_hasher->getHumanReadableName();
     } catch (Exception $ex) {
       return pht('Unknown');
     }
   }
 
 }