Ticket #9577: 9577.diff

wp-includes/registration.php

@@ -48 +48 @@
  */
 function validate_username( $username ) {
         $sanitized = sanitize_user( $username, true );
-        $valid = ( $sanitized == $username );
+        $valid = ( $sanitized == $username && !preg_match("/^\d+$/", $username) );
         return apply_filters( 'validate_username', $valid, $username );
 }
 

wp-includes/pluggable.php

@@ -523 +523 @@
                 return false;
         }
 
-        $user = get_userdatabylogin($username);
+        $user = get_userdata($user_id);
         if ( ! $user ) {
-                do_action('auth_cookie_bad_username', $cookie_elements);
+                do_action('auth_cookie_bad_id', $cookie_elements);
                 return false;
         }
 
         $pass_frag = substr($user->user_pass, 8, 4);
 
-        $key = wp_hash($username . $pass_frag . '|' . $expiration, $scheme);
-        $hash = hash_hmac('md5', $username . '|' . $expiration, $key);
+        $key = wp_hash($user->user_login . $pass_frag . '|' . $expiration, $scheme);
+        $hash = hash_hmac('md5', $user->user_login . '|' . $expiration, $key);
 
         if ( $hmac != $hash ) {
                 do_action('auth_cookie_bad_hash', $cookie_elements);
@@ -566 +566 @@
         $key = wp_hash($user->user_login . $pass_frag . '|' . $expiration, $scheme);
         $hash = hash_hmac('md5', $user->user_login . '|' . $expiration, $key);
 
-        $cookie = $user->user_login . '|' . $expiration . '|' . $hash;
+        $cookie = $user->ID . '|' . $expiration . '|' . $hash;
 
         return apply_filters('auth_cookie', $cookie, $user_id, $expiration, $scheme);
 }
@@ -613 +613 @@
         if ( count($cookie_elements) != 3 )
                 return false;
 
-        list($username, $expiration, $hmac) = $cookie_elements;
+        list($user_id, $expiration, $hmac) = $cookie_elements;
 
-        return compact('username', 'expiration', 'hmac', 'scheme');
+        return compact('user_id', 'expiration', 'hmac', 'scheme');
 }
 endif;