Ticket #19599: 19599.3.patch

wp-includes/default-constants.php

@@ -140 +140 @@
  * @since 3.0.0
  */
 function wp_cookie_constants( ) {
-        global $wp_default_secret_key;
-
         /**
          * Used to guarantee unique hash cookies
          * @since 1.5
@@ -155 +153 @@
         }
 
         /**
-         * Should be exactly the same as the default value of SECRET_KEY in wp-config-sample.php
-         * @since 2.5.0
-         */
-        $wp_default_secret_key = 'put your unique phrase here';
-
-        /**
          * @since 2.0.0
          */
         if ( !defined('USER_COOKIE') )

wp-includes/pluggable.php

@@ -1313 +1313 @@
  * @return string Salt value
  */
 function wp_salt($scheme = 'auth') {
-        global $wp_default_secret_key;
+        $secret_keys = array();
+
+        if ( defined( 'AUTH_KEY' ) )
+                $secret_keys[] = AUTH_KEY;
+        if ( defined( 'SECURE_AUTH_KEY' ) )
+                $secret_keys[] = SECURE_AUTH_KEY;
+        if ( defined( 'LOGGED_IN_KEY' ) )
+                $secret_keys[] = LOGGED_IN_KEY;
+        if ( defined( 'NONCE_KEY' ) )
+                $secret_keys[] = NONCE_KEY;
+        if ( defined( 'AUTH_SALT' ) )
+                $secret_keys[] = AUTH_SALT;
+        if ( defined( 'SECURE_AUTH_SALT' ) )
+                $secret_keys[] = SECURE_AUTH_SALT;
+        if ( defined( 'LOGGED_IN_SALT' ) )
+                $secret_keys[] = LOGGED_IN_SALT;
+        if ( defined( 'NONCE_SALT' ) )
+                $secret_keys[] = NONCE_SALT;
+
+        $wp_default_secret_key = '';
+        if ( !empty( $secret_keys ) ) {
+                $secret_keys_count = array_count_values( $secret_keys );
+                arsort( $secret_keys_count );
+                if ( array_shift( array_values( $secret_keys_count ) ) > 1 )
+                        $wp_default_secret_key = array_shift( array_keys( $secret_keys_count ) );
+        }
+
         $secret_key = '';
         if ( defined('SECRET_KEY') && ('' != SECRET_KEY) && ( $wp_default_secret_key != SECRET_KEY) )
                 $secret_key = SECRET_KEY;