Username disclosure

[lferro9000]

https://github.com/ZF-Commons/ZfcUser/blob/1.x/src/ZfcUser/Authentication/Adapter/Db.php

The way the user / login is performed is potentially disclosing the username due to the fact that the operation for an existing user is way different then one for an inexistent one.

I'm not an expert in security btw, but please take a look at:

http://blog.ircmaxell.com/2014/11/its-all-about-time.html

And probably the comparison / hashing should be updated to use hash_password and hash_equals (there is a compatibility library if the version of php doesn't support such):

https://github.com/ircmaxell/password_compat

Cheers,
LF