Ticket #19821: 19732.diff

wp-includes/pluggable.php

@@ -506 +506 @@
  * @param string $scheme Optional. The cookie scheme to use: auth, secure_auth, or logged_in
  * @return bool|int False if invalid cookie, User ID if valid.
  */
-function wp_validate_auth_cookie($cookie = '', $scheme = '') {
-        if ( ! $cookie_elements = wp_parse_auth_cookie($cookie, $scheme) ) {
-                do_action('auth_cookie_malformed', $cookie, $scheme);
+function wp_validate_auth_cookie( $cookie = '', $scheme = '' ) {
+        if ( ! $cookie_elements = wp_parse_auth_cookie( $cookie, $scheme ) ) {
+                do_action( 'auth_cookie_malformed', $cookie, $scheme );
                 return false;
         }
 
-        extract($cookie_elements, EXTR_OVERWRITE);
+        extract( $cookie_elements, EXTR_OVERWRITE );
 
         $expired = $expiration;
 
@@ -522 +522 @@
 
         // Quick check to see if an honest cookie has expired
         if ( $expired < time() ) {
-                do_action('auth_cookie_expired', $cookie_elements);
+                do_action( 'auth_cookie_expired', $cookie_elements );
                 return false;
         }
 
-        $user = get_user_by('login', $username);
+        $user = get_user_by( 'login', $username );
         if ( ! $user ) {
-                do_action('auth_cookie_bad_username', $cookie_elements);
+                do_action( 'auth_cookie_bad_username', $cookie_elements );
                 return false;
         }
 
-        $pass_frag = substr($user->user_pass, 8, 4);
+        $pass_frag = substr( $user->user_pass, 8, 4 );
 
-        $key = wp_hash($username . $pass_frag . '|' . $expiration, $scheme);
-        $hash = hash_hmac('md5', $username . '|' . $expiration, $key);
+        $key = wp_hash( $username . $pass_frag . '|' . $expiration, $scheme );
+        $hash = hash_hmac( 'md5', $username . '|' . $expiration, $key );
 
         if ( $hmac != $hash ) {
-                do_action('auth_cookie_bad_hash', $cookie_elements);
+                do_action( 'auth_cookie_bad_hash', $cookie_elements );
                 return false;
         }
+        
+        $user = apply_filters( 'validate_auth_cookie', $user );
+        if ( $user === false ) {
+                do_action( 'auth_cookie_invalid', $cookie_elements );
+                return false;
+        }
 
         if ( $expiration < time() ) // AJAX/POST grace period set above
                 $GLOBALS['login_grace_period'] = 1;
 
-        do_action('auth_cookie_valid', $cookie_elements, $user);
+        do_action( 'auth_cookie_valid', $cookie_elements, $user );
 
         return $user->ID;
 }