Ticket #2394: 2394-phpass.patch

wp-login.php

@@ -1 +1 @@
 <?php
+require( dirname(__FILE__) . '/wp-includes/class-phpass.php');
 require( dirname(__FILE__) . '/wp-config.php' );
 
 $action = $_REQUEST['action'];
@@ -184 +185 @@
 
         // Generate something random for a password... md5'ing current time with a rand salt
         $new_pass = substr( md5( uniqid( microtime() ) ), 0, 7);
-        $wpdb->query("UPDATE $wpdb->users SET user_pass = MD5('$new_pass'), user_activation_key = '' WHERE user_login = '$user->user_login'");
+        // By default, use the portable hash from phpass
+        $hasher = new PasswordHash(8, TRUE);
+        $new_hash = $hasher->HashPassword($new_pass); 
+        $wpdb->query("UPDATE $wpdb->users SET user_pass = '$new_hash', user_activation_key = '' WHERE user_login = '$user->user_login'");
         wp_cache_delete($user->ID, 'users');
         wp_cache_delete($user->user_login, 'userlogins');
         $message  = sprintf(__('Username: %s'), $user->user_login) . "\r\n";

wp-includes/pluggable.php

@@ -1 +1 @@
 <?php
 
+include_once(ABSPATH . WPINC . '/class-phpass.php');
+
         /* These functions can be replaced via plugins.  They are loaded after
          plugins are loaded. */
 
@@ -298 +300 @@
         } else {
                 // If the password is already_md5, it has been double hashed.
                 // Otherwise, it is plain text.
+                if(strlen($login->user_pass) > 32 && !$already_md5) {
+                        //If the stored hash is longer than an MD5, presume the
+                        //new style phpass portable hash.
+                        $hasher = new PasswordHash(8, TRUE);
+                        if ($hasher->CheckPassword($password, $login->user_pass)){
+                                //Successful match
+                                return true;
+                        } else {
+                                //Fail!
+                                $pwd = '';
+                                return false;
+                        }
+                } elseif (strlen($login->user_pass) > 32 && $already_md5) {
+                        //If password has already already_md5 it has been double hashed
+                        $test = md5($login->user_pass);
+                        return ($test == $password);
+                }
                 if ( ($already_md5 && md5($login->user_pass) == $password) || ($login->user_login == $username && $login->user_pass == md5($password)) ) {
                         return true;
                 } else {
@@ -456 +475 @@
 
 if ( !function_exists('wp_setcookie') ) :
 function wp_setcookie($username, $password, $already_md5 = false, $home = '', $siteurl = '', $remember = false) {
-        if ( !$already_md5 )
-                $password = md5( md5($password) ); // Double hash the password in the cookie.
+        $user = get_userdatabylogin($username);
+        if ( !$already_md5) {
+                $password = md5($user->user_pass); // Double hash the password in the cookie.
+        }
 
         if ( empty($home) )
                 $cookiepath = COOKIEPATH;

wp-includes/registration.php

@@ -1 +1 @@
 <?php
 
+include_once(ABSPATH . WPINC . '/class-phpass.php');
+
 /**
  * Checks whether the given username exists.
  * @param string $username Username.
@@ -52 +54 @@
                 $update = true;
         } else {
                 $update = false;
-                // Password is not hashed when creating new user.
-                $user_pass = md5($user_pass);
+                //If this is a new user being created, we need to
+                //use the phpass portable hash
+                $hasher = new PasswordHash(8, TRUE);
+                $user_pass = $hasher->HashPassword($user_pass);
         }
 
         $user_login = sanitize_user($user_login, true);
@@ -154 +158 @@
         // If password is changing, hash it now.
         if ( ! empty($userdata['user_pass']) ) {
                 $plaintext_pass = $userdata['user_pass'];
-                $userdata['user_pass'] = md5($userdata['user_pass']);
+                //Use the new phpass portable hash
+                $hasher = new PasswordHash(8, TRUE);
+                $userdata['user_pass'] = $hasher->HashPassword($userdata['user_pass']);
         }
 
         // Merge old and new fields with new fields overwriting old ones.
@@ -205 +211 @@
         return wp_create_user($username, $password, $email);
 }
 
-?>
- No newline at end of file
+?>

wp-includes/user.php

@@ -1 +1 @@
 <?php
 
+include_once(ABSPATH . WPINC . '/class-phpass.php');
+
 function get_profile($field, $user = false) {
         global $wpdb;
         if ( !$user )
@@ -16 +18 @@
 // TODO: xmlrpc only.  Maybe move to xmlrpc.php.
 function user_pass_ok($user_login,$user_pass) {
         $userdata = get_userdatabylogin($user_login);
-
-        return (md5($user_pass) == $userdata->user_pass);
+        if (strlen($userdata->user_pass) > 32) {
+                //The hash is longer than MD5, so presume the new phpass portable hash
+                //is being used.
+                $hasher = new PasswordHash(8, TRUE);
+                return($hasher->CheckPassword($user_pass, $userdata->user_pass));
+        } else {
+                return (md5($user_pass) == $userdata->user_pass);
+        }
 }
 
 //