original_string: protected function _findUser($username, $password = null)
      {
          $result = $this->_query($username)->first();
  
          if (empty($result)) {
              // Waste time hashing the password, to prevent
              // timing side-channels. However, don't hash
              // null passwords as authentication systems
              // like digest auth don't use passwords
              // and hashing *could* create a timing side-channel.
              if ($password !== null) {
                  $hasher = $this->passwordHasher();
                  $hasher->hash($password);
              }
  
              return false;
          }
  
          $passwordField = $this->_config['fields']['password'];
          if ($password !== null) {
              $hasher = $this->passwordHasher();
              $hashedPassword = $result->get($passwordField);
              if (!$hasher->check($password, $hashedPassword)) {
                  return false;
              }
  
              $this->_needsPasswordRehash = $hasher->needsRehash($hashedPassword);
              $result->unsetProperty($passwordField);
          }
          $hidden = $result->getHidden();
          if ($password === null && in_array($passwordField, $hidden)) {
              $key = array_search($passwordField, $hidden);
              unset($hidden[$key]);
              $result->setHidden($hidden);
          }
  
          return $result->toArray();
      }
code: protected function _findUser($username, $password = null)
      {
          $result = $this->_query($username)->first();
  
          if (empty($result)) {
              // Waste time hashing the password, to prevent
              // timing side-channels. However, don't hash
              // null passwords as authentication systems
              // like digest auth don't use passwords
              // and hashing *could* create a timing side-channel.
              if ($password !== null) {
                  $hasher = $this->passwordHasher();
                  $hasher->hash($password);
              }
  
              return false;
          }
  
          $passwordField = $this->_config['fields']['password'];
          if ($password !== null) {
              $hasher = $this->passwordHasher();
              $hashedPassword = $result->get($passwordField);
              if (!$hasher->check($password, $hashedPassword)) {
                  return false;
              }
  
              $this->_needsPasswordRehash = $hasher->needsRehash($hashedPassword);
              $result->unsetProperty($passwordField);
          }
          $hidden = $result->getHidden();
          if ($password === null && in_array($passwordField, $hidden)) {
              $key = array_search($passwordField, $hidden);
              unset($hidden[$key]);
              $result->setHidden($hidden);
          }
  
          return $result->toArray();
      }
code_tokens: protected function _findUser ( $ username , $ password = null ) { $ result = $ this -> _query ( $ username ) -> first ( ) ; if ( empty ( $ result ) ) { // Waste time hashing the password, to prevent // timing side-channels. However, don't hash // null passwords as authentication systems // like digest auth don't use passwords // and hashing *could* create a timing side-channel. if ( $ password !== null ) { $ hasher = $ this -> passwordHasher ( ) ; $ hasher -> hash ( $ password ) ; } return false ; } $ passwordField = $ this -> _config [ 'fields' ] [ 'password' ] ; if ( $ password !== null ) { $ hasher = $ this -> passwordHasher ( ) ; $ hashedPassword = $ result -> get ( $ passwordField ) ; if ( ! $ hasher -> check ( $ password , $ hashedPassword ) ) { return false ; } $ this -> _needsPasswordRehash = $ hasher -> needsRehash ( $ hashedPassword ) ; $ result -> unsetProperty ( $ passwordField ) ; } $ hidden = $ result -> getHidden ( ) ; if ( $ password === null && in_array ( $ passwordField , $ hidden ) ) { $ key = array_search ( $ passwordField , $ hidden ) ; unset ( $ hidden [ $ key ] ) ; $ result -> setHidden ( $ hidden ) ; } return $ result -> toArray ( ) ; }
docstring: Find a user record using the username and password provided.
  
  Input passwords will be hashed even when a user doesn't exist. This
  helps mitigate timing attacks that are attempting to find valid usernames.
  
  @param string $username The username/identifier.
  @param string|null $password The password, if not provided password checking is skipped
  and result of find is returned.
  @return bool|array Either false on failure, or an array of user data.
docstring_tokens: Find a user record using the username and password provided .