Second parameter should be user-provided value

Closes #3491402

core/modules/user/src/Controller/UserController.php

@@ -342,7 +342,7 @@ protected function determineErrorRedirect(?UserInterface $user, int $timestamp,
   protected function validatePathParameters(UserInterface $user, int $timestamp, string $hash, int $timeout = 0): bool {
     $current = \Drupal::time()->getRequestTime();
     $timeout_valid = ((!empty($timeout) && $current - $timestamp < $timeout) || empty($timeout));
-    return ($timestamp >= $user->getLastLoginTime()) && $timestamp <= $current && $timeout_valid && hash_equals($hash, user_pass_rehash($user, $timestamp));
+    return ($timestamp >= $user->getLastLoginTime()) && $timestamp <= $current && $timeout_valid && hash_equals(user_pass_rehash($user, $timestamp), $hash);
   }
 
   /**