Ticket #2394: pass_hash.diff

wp-login.php

@@ -184 +184 @@
 
         // Generate something random for a password... md5'ing current time with a rand salt
         $new_pass = substr( md5( uniqid( microtime() ) ), 0, 7);
-        $wpdb->query("UPDATE $wpdb->users SET user_pass = MD5('$new_pass'), user_activation_key = '' WHERE user_login = '$user->user_login'");
+        $new_hash = wp_hash_password($new_pass); 
+        $wpdb->query("UPDATE $wpdb->users SET user_pass = '$new_hash', user_activation_key = '' WHERE ID = '$user->ID'");
         wp_cache_delete($user->ID, 'users');
-        wp_cache_delete($user->user_login, 'userlogins');
         $message  = sprintf(__('Username: %s'), $user->user_login) . "\r\n";
         $message .= sprintf(__('Password: %s'), $new_pass) . "\r\n";
         $message .= get_option('siteurl') . "/wp-login.php\r\n";

wp-includes/pluggable.php

@@ -307 +307 @@
         }
 
         $login = get_userdatabylogin($username);
-        //$login = $wpdb->get_row("SELECT ID, user_login, user_pass FROM $wpdb->users WHERE user_login = '$username'");
 
-        if (!$login) {
+        if ( !$login || ($login->user_login != $username) ) {
                 $error = __('<strong>ERROR</strong>: Invalid username.');
                 return false;
+        }
+
+        // If the password is already_md5, it has been double hashed.
+        // Otherwise, it is plain text.
+        if ( !$already_md5 ) {
+                if ( wp_check_password($password, $login->user_pass) ) {
+                        // If using old md5 password, rehash.
+                        if ( strlen($login->user_pass) <= 32 ) {
+                                $hash = wp_hash_password($password);
+                                $wpdb->query("UPDATE $wpdb->users SET user_pass = '$hash', user_activation_key = '' WHERE ID = '$login->ID'");
+                                wp_cache_delete($login->ID, 'users');
+                        }
+
+                        return true;
+                }
         } else {
-                // If the password is already_md5, it has been double hashed.
-                // Otherwise, it is plain text.
-                if ( ($already_md5 && md5($login->user_pass) == $password) || ($login->user_login == $username && $login->user_pass == md5($password)) ) {
+                if ( md5($login->user_pass) == $password )
                         return true;
-                } else {
-                        $error = __('<strong>ERROR</strong>: Incorrect password.');
-                        return false;
-                }
         }
+
+        $error = __('<strong>ERROR</strong>: Incorrect password.');
+        return false;
 }
 endif;
 
@@ -473 +484 @@
 
 if ( !function_exists('wp_setcookie') ) :
 function wp_setcookie($username, $password, $already_md5 = false, $home = '', $siteurl = '', $remember = false) {
-        if ( !$already_md5 )
-                $password = md5( md5($password) ); // Double hash the password in the cookie.
+        $user = get_userdatabylogin($username);
+        if ( !$already_md5) {
+                $password = md5($user->user_pass); // Double hash the password in the cookie.
+        }
 
         if ( empty($home) )
                 $cookiepath = COOKIEPATH;
@@ -700 +713 @@
 }
 endif;
 
+if ( !function_exists('wp_hash_password') ) :
+function wp_hash_password($password) {
+        global $wp_hasher;
+
+        if ( empty($wp_hasher) ) {
+                require_once( ABSPATH . 'wp-includes/class-phpass.php');
+                // By default, use the portable hash from phpass
+                $wp_hasher = new PasswordHash(8, TRUE);
+        }
+        
+        return $wp_hasher->HashPassword($password); 
+}
+endif;
+
+if ( !function_exists('wp_check_password') ) :
+function wp_check_password($password, $hash) {
+        global $wp_hasher;
+
+        if ( strlen($hash) <= 32 )
+                return ( $hash == md5($password) );
+
+        // If the stored hash is longer than an MD5, presume the
+        // new style phpass portable hash.
+        if ( empty($wp_hasher) ) {
+                require_once( ABSPATH . 'wp-includes/class-phpass.php');
+                // By default, use the portable hash from phpass
+                $wp_hasher = new PasswordHash(8, TRUE);
+        }
+
+        return $wp_hasher->CheckPassword($password, $hash);
+}
+endif;
+
 ?>

wp-includes/registration.php

@@ -54 +54 @@
                 $update = true;
         } else {
                 $update = false;
-                // Password is not hashed when creating new user.
-                $user_pass = md5($user_pass);
+                // Hash the password
+                $user_pass = wp_hash_password($user_pass);
         }
 
         $user_login = sanitize_user($user_login, true);
@@ -156 +156 @@
         // If password is changing, hash it now.
         if ( ! empty($userdata['user_pass']) ) {
                 $plaintext_pass = $userdata['user_pass'];
-                $userdata['user_pass'] = md5($userdata['user_pass']);
+                $userdata['user_pass'] = wp_hash_password($userdata['user_pass']);
         }
 
         // Merge old and new fields with new fields overwriting old ones.
@@ -207 +207 @@
         return wp_create_user($username, $password, $email);
 }
 
-?>
- No newline at end of file
+?>

wp-includes/user.php

@@ -16 +16 @@
 // TODO: xmlrpc only.  Maybe move to xmlrpc.php.
 function user_pass_ok($user_login,$user_pass) {
         $userdata = get_userdatabylogin($user_login);
-
-        return (md5($user_pass) == $userdata->user_pass);
+        return wp_check_password($user_pass, $userdata->user_pass);
 }
 
 //