Merge pull request #663 from dalf/mod_secret_key

changes about the secret_key

1 files changed, 2 insertions, 2 deletions

diff --git a/searx/webapp.py b/searx/webapp.py
index a7812f181..a2aa84d9d 100755
--- a/searx/webapp.py
+++ b/searx/webapp.py
@@ -71,6 +71,7 @@ from searx.webutils import (
     get_themes,
     prettify_url,
     new_hmac,
+    is_hmac_of,
     is_flask_run_cmdline,
 )
 from searx.webadapter import (
@@ -1067,8 +1068,7 @@ def image_proxy():
     if not url:
         return '', 400
 
-    h = new_hmac(settings['server']['secret_key'], url.encode())
-    if h != request.args.get('h'):
+    if not is_hmac_of(settings['server']['secret_key'], url.encode(), request.args.get('h', '')):
         return '', 400
 
     maximum_size = 5 * 1024 * 1024