security #40 Fix request authentication safe hash comparison (sstok)

This PR was merged into the master branch.

Discussion
----------

Fix request authentication safe hash comparison

|Q            |A  |
|---          |---|
|Bug Fix?     |yes|
|New Feature? |no |
|BC Breaks?   |no  |
|Deprecations?|no |
|Tests Pass?  |yes|
|Fixed Tickets|   |
|License      |MIT|

Commits
-------

d74cceb Fix request authentication safe hash comparison

Author: weaverryan

src/AppBundle/Issues/GitHubRequestHandler.php

@@ -90,6 +90,6 @@ private function authenticate($hash, $key, $data)
             throw new \RuntimeException('"hash" extension is needed to check request signature.');
         }
 
-        return $hash !== 'sha1='.hash_hmac('sha1', $data, $key);
+        return hash_equals($hash, 'sha1='.hash_hmac('sha1', $data, $key));
     }
 }