Ticket #20276: 20276.5.diff

src/wp-includes/pluggable.php

@@ -586 +586 @@
  * @since 2.5.0
  */
 function wp_logout() {
+        wp_destroy_current_session();
         wp_clear_auth_cookie();
 
         /**
@@ -631 +632 @@
         $scheme = $cookie_elements['scheme'];
         $username = $cookie_elements['username'];
         $hmac = $cookie_elements['hmac'];
+        $token = $cookie_elements['token'];
         $expired = $expiration = $cookie_elements['expiration'];
 
         // Allow a grace period for POST and AJAX requests
@@ -666 +668 @@
 
         $pass_frag = substr($user->user_pass, 8, 4);
 
-        $key = wp_hash($username . $pass_frag . '|' . $expiration, $scheme);
-        $hash = hash_hmac('md5', $username . '|' . $expiration, $key);
+        $key = wp_hash( $username . '|' . $pass_frag . '|' . $expiration . '|' . $token, $scheme );
+        $hash = hash_hmac( 'md5', $username . '|' . $expiration . '|' . $token, $key );
 
         if ( hash_hmac( 'md5', $hmac, $key ) !== hash_hmac( 'md5', $hash, $key ) ) {
                 /**
@@ -681 +683 @@
                 return false;
         }
 
-        if ( $expiration < time() ) {// AJAX/POST grace period set above
+        $manager = WP_Session_Tokens::get_instance( $user->ID );
+        if ( ! $manager->verify_token( $token ) ) {
+                do_action( 'auth_cookie_bad_session_token', $cookie_elements );
+                return false;
+        }
+
+        if ( $expiration < time() ) { // AJAX/POST grace period set above
                 $GLOBALS['login_grace_period'] = 1;
         }
 
@@ -708 +716 @@
  * @param int $user_id User ID
  * @param int $expiration Cookie expiration in seconds
  * @param string $scheme Optional. The cookie scheme to use: auth, secure_auth, or logged_in
- * @return string Authentication cookie contents
+ * @param string $token User's session token to use for this cookie
+ * @return string Authentication cookie contents. Empty string if user does not exist.
  */
-function wp_generate_auth_cookie($user_id, $expiration, $scheme = 'auth') {
+function wp_generate_auth_cookie( $user_id, $expiration, $scheme = 'auth', $token = '' ) {
         $user = get_userdata($user_id);
+        if ( ! $user ) {
+                return '';
+        }
 
+        if ( ! $token ) {
+                $manager = WP_Session_Tokens::get_instance( $user_id );
+                $token = $manager->create_token( $expiration );
+        }
+
         $pass_frag = substr($user->user_pass, 8, 4);
 
-        $key = wp_hash($user->user_login . $pass_frag . '|' . $expiration, $scheme);
-        $hash = hash_hmac('md5', $user->user_login . '|' . $expiration, $key);
+        $key = wp_hash( $user->user_login . '|' . $pass_frag . '|' . $expiration . '|' . $token, $scheme );
+        $hash = hash_hmac( 'md5', $user->user_login . '|' . $expiration . '|' . $token, $key );
 
-        $cookie = $user->user_login . '|' . $expiration . '|' . $hash;
+        $cookie = $user->user_login . '|' . $expiration . '|' . $token . '|' . $hash;
 
         /**
          * Filter the authentication cookie.
@@ -772 +789 @@
         }
 
         $cookie_elements = explode('|', $cookie);
-        if ( count($cookie_elements) != 3 )
+        if ( count( $cookie_elements ) !== 4 ) {
                 return false;
+        }
 
-        list($username, $expiration, $hmac) = $cookie_elements;
+        list( $username, $expiration, $token, $hmac ) = $cookie_elements;
 
-        return compact('username', 'expiration', 'hmac', 'scheme');
+        return compact( 'username', 'expiration', 'token', 'hmac', 'scheme' );
 }
 endif;
 
@@ -793 +811 @@
  *
  * @param int $user_id User ID
  * @param bool $remember Whether to remember the user
+ * @param mixed $secure  Whether the admin cookies should only be sent over HTTPS.
+ *                       Default is_ssl().
  */
 function wp_set_auth_cookie($user_id, $remember = false, $secure = '') {
         if ( $remember ) {
@@ -850 +870 @@
                 $scheme = 'auth';
         }
 
-        $auth_cookie = wp_generate_auth_cookie($user_id, $expiration, $scheme);
-        $logged_in_cookie = wp_generate_auth_cookie($user_id, $expiration, 'logged_in');
+        $manager = WP_Session_Tokens::get_instance( $user_id );
+        $token = $manager->create_token( $expiration );
 
+        $auth_cookie = wp_generate_auth_cookie( $user_id, $expiration, $scheme, $token );
+        $logged_in_cookie = wp_generate_auth_cookie( $user_id, $expiration, 'logged_in', $token );
+
         /**
          * Fires immediately before the authentication cookie is set.
          *
@@ -1678 +1701 @@
                 $uid = apply_filters( 'nonce_user_logged_out', $uid, $action );
         }
 
+        $token = wp_get_session_token();
         $i = wp_nonce_tick();
 
         // Nonce generated 0-12 hours ago
-        if ( substr(wp_hash($i . $action . $uid, 'nonce'), -12, 10) === $nonce )
+        if ( $nonce === substr( wp_hash( $i . '|' . $action . '|' . $uid . '|' . $token, 'nonce'), -12, 10 ) ) {
                 return 1;
+        }
+
         // Nonce generated 12-24 hours ago
-        if ( substr(wp_hash(($i - 1) . $action . $uid, 'nonce'), -12, 10) === $nonce )
+        if ( $nonce === substr( wp_hash( ( $i - 1 ) . '|' . $action . '|' . $uid . '|' . $token, 'nonce' ), -12, 10 ) ) {
                 return 2;
+        }
+
         // Invalid nonce
         return false;
 }
@@ -1708 +1736 @@
                 $uid = apply_filters( 'nonce_user_logged_out', $uid, $action );
         }
 
+        $token = wp_get_session_token();
         $i = wp_nonce_tick();
 
-        return substr(wp_hash($i . $action . $uid, 'nonce'), -12, 10);
+        return substr( wp_hash( $i . '|' . $action . '|' . $uid . '|' . $token, 'nonce' ), -12, 10 );
 }
 endif;
 

src/wp-includes/user.php

@@ -2127 +2127 @@
 
         return $user_id;
 }
+
+/**
+ * Class for managing a user's session tokens.
+ */
+class WP_Session_Tokens {
+
+        /**
+         * User ID.
+         *
+         * @since 4.0.0
+         *
+         * @var int User ID.
+         */
+        protected $user_id;
+
+        /**
+         * Protected constructor.
+         *
+         * @param int $user_id User whose session to manage.
+         */
+        protected function __construct( $user_id ) {
+                $this->user_id = $user_id;
+        }
+
+        /**
+         * Get a session token manager instance for a user.
+         *
+         * This method contains a filter that allows a plugin to swap out
+         * the session manager for a subclass of WP_Session_Tokens.
+         *
+         * @since 4.0.0
+         *
+         * @param int $user_id User whose session to manage.
+         */
+        final public static function get_instance( $user_id ) {
+                /**
+                 * Filter the session token manager used.
+                 *
+                 * @since 4.0.0
+                 *
+                 * @param string $session Name of class to use as the manager.
+                 *                        Default 'WP_Session_Tokens'.
+                 */
+                $manager = apply_filters( 'session_token_manager', 'WP_Session_Tokens' );
+                return new $manager( $user_id );
+        }
+
+        /**
+         * Validate a user's session token as authentic.
+         *
+         * Checks that the given token is present in the database and hasn't expired.
+         *
+         * @since 4.0.0
+         *
+         * @param string $token Token to verify.
+         * @return bool Whether the token is valid for the user.
+         */
+        final public function verify_token( $token ) {
+                $sessions = $this->get_sessions();
+                $verifier = hash( 'sha256', $token );
+                return isset( $sessions[ $verifier ] ) && $sessions[ $verifier ]['expiration'] >= time();
+        }
+
+        /**
+         * Generate a cookie session identification token.
+         *
+         * A session identification token is a long, random string. It is used to
+         * link a cookie to an expiration time and to ensure that cookies become
+         * invalidated upon logout. This function generates a token and stores it
+         * as user meta with the associated expiration time.
+         *
+         * Will also remove any expired tokens from the database.
+         *
+         * @since 4.0.0
+         *
+         * @param int $expiration Session expiration timestamp.
+         * @return string Session identification token.
+         */
+        final public function create_token( $expiration ) {
+                /**
+                 * Filter the information attached to the newly created session.
+                 *
+                 * Could be used in the future to attach information such as
+                 * IP address or user agent to a session.
+                 *
+                 * @since 4.0.0
+                 *
+                 * @param array $session Array of extra data.
+                 * @param int   $user_id User ID.
+                 */
+                $session = apply_filters( 'attach_session_information', array(), $this->user_id );
+                $session['expiration'] = $expiration;
+
+                $sessions = $this->get_sessions();
+                if ( ! $sessions )
+                        $sessions = array();
+
+                $token = wp_generate_password( 40, false, false );
+                $verifier = hash( 'sha256', $token );
+
+                $sessions[ $verifier ] = $session;
+
+                $this->update_sessions( $sessions );
+                return $token;
+        }
+
+        /**
+         * Remove a session token from the database.
+         *
+         * Will also remove any expired tokens from the database.
+         *
+         * @since 4.0.0
+         */
+        final public function destroy_session( $token ) {
+                $sessions = $this->get_sessions();
+                $verifier = hash( 'sha256', $token );
+                unset( $sessions[ $verifier ] );
+
+                $this->update_sessions( $sessions );
+        }
+
+        /**
+         * Remove all session tokens from the database.
+         *
+         * @since 4.0.0
+         */
+        final public function destroy_sessions() {
+                $this->update_sessions();
+        }
+
+        /**
+         * Get all sessions of a user.
+         *
+         * @since 4.0.0
+         *
+         * @return array
+         */
+        public function get_sessions() {
+                $sessions = get_user_meta( $this->user_id, 'session_tokens', true );
+
+                if ( ! is_array( $sessions ) ) {
+                        return array();
+                }
+
+                foreach ( $sessions as &$session ) {
+                        if ( is_int( $session ) ) {
+                                $session = array( 'expiration' => $session );
+                        }
+                }
+                return $sessions;
+        }
+
+        /**
+         * Update a user's sessions.
+         *
+         * @since 4.0.0
+         *
+         * @param array $sessions
+         */
+        protected function update_sessions( $sessions ) {
+                // Remove expired sessions.
+                $time = time();
+                $reduce = ! has_filter( 'attach_session_information' );
+                foreach ( $sessions as $verifier => $session ) {
+                        if ( $session['expiration'] < $time ) {
+                                unset( $sessions[ $verifier ] );
+                        }
+
+                        if ( $reduce ) {
+                                $sessions[ $verifier ] = $session['expiration'];
+                        }
+                }
+
+                if ( $sessions ) {
+                        update_user_meta( $this->user_id, 'session_tokens', $sessions );
+                } else {
+                        delete_user_meta( $this->user_id, 'session_tokens' );
+                }
+        }
+}
+
+/**
+ * Remove the current session token from the database.
+ *
+ * Will also remove any expired tokens from the database.
+ *
+ * @since 4.0.0
+ */
+function wp_destroy_current_session() {
+        $token = wp_get_session_token();
+        if ( $token ) {
+                $manager = WP_Session_Tokens::get_instance( get_current_user_id() );
+                $manager->destroy_session( $token );
+        }
+}
+
+/**
+ * Retrieve the current session token from the logged_in cookie.
+ *
+ * @since 4.0.0
+ *
+ * @return string
+ */
+function wp_get_session_token() {
+        $cookie = wp_parse_auth_cookie( '', 'logged_in' );
+        return ! empty( $cookie['token'] ) ? $cookie['token'] : '';
+}