WordPress.org

Make WordPress Core

Ticket #2394: 2394-phpass.patch

File 2394-phpass.patch, 4.9 KB (added by pishmishy, 13 years ago)

Implentation of salted passwords through the use of phpass

  • wp-login.php

     
    11<?php
     2require( dirname(__FILE__) . '/wp-includes/class-phpass.php');
    23require( dirname(__FILE__) . '/wp-config.php' );
    34
    45$action = $_REQUEST['action'];
     
    184185
    185186        // Generate something random for a password... md5'ing current time with a rand salt
    186187        $new_pass = substr( md5( uniqid( microtime() ) ), 0, 7);
    187         $wpdb->query("UPDATE $wpdb->users SET user_pass = MD5('$new_pass'), user_activation_key = '' WHERE user_login = '$user->user_login'");
     188        // By default, use the portable hash from phpass
     189        $hasher = new PasswordHash(8, TRUE);
     190        $new_hash = $hasher->HashPassword($new_pass);
     191        $wpdb->query("UPDATE $wpdb->users SET user_pass = '$new_hash', user_activation_key = '' WHERE user_login = '$user->user_login'");
    188192        wp_cache_delete($user->ID, 'users');
    189193        wp_cache_delete($user->user_login, 'userlogins');
    190194        $message  = sprintf(__('Username: %s'), $user->user_login) . "\r\n";
  • wp-includes/pluggable.php

     
    11<?php
    22
     3include_once(ABSPATH . WPINC . '/class-phpass.php');
     4
    35        /* These functions can be replaced via plugins.  They are loaded after
    46         plugins are loaded. */
    57
     
    298300        } else {
    299301                // If the password is already_md5, it has been double hashed.
    300302                // Otherwise, it is plain text.
     303                if(strlen($login->user_pass) > 32 && !$already_md5) {
     304                        //If the stored hash is longer than an MD5, presume the
     305                        //new style phpass portable hash.
     306                        $hasher = new PasswordHash(8, TRUE);
     307                        if ($hasher->CheckPassword($password, $login->user_pass)){
     308                                //Successful match
     309                                return true;
     310                        } else {
     311                                //Fail!
     312                                $pwd = '';
     313                                return false;
     314                        }
     315                } elseif (strlen($login->user_pass) > 32 && $already_md5) {
     316                        //If password has already already_md5 it has been double hashed
     317                        $test = md5($login->user_pass);
     318                        return ($test == $password);
     319                }
    301320                if ( ($already_md5 && md5($login->user_pass) == $password) || ($login->user_login == $username && $login->user_pass == md5($password)) ) {
    302321                        return true;
    303322                } else {
     
    456475
    457476if ( !function_exists('wp_setcookie') ) :
    458477function wp_setcookie($username, $password, $already_md5 = false, $home = '', $siteurl = '', $remember = false) {
    459         if ( !$already_md5 )
    460                 $password = md5( md5($password) ); // Double hash the password in the cookie.
     478        $user = get_userdatabylogin($username);
     479        if ( !$already_md5) {
     480                $password = md5($user->user_pass); // Double hash the password in the cookie.
     481        }
    461482
    462483        if ( empty($home) )
    463484                $cookiepath = COOKIEPATH;
  • wp-includes/registration.php

     
    11<?php
    22
     3include_once(ABSPATH . WPINC . '/class-phpass.php');
     4
    35/**
    46 * Checks whether the given username exists.
    57 * @param string $username Username.
     
    5254                $update = true;
    5355        } else {
    5456                $update = false;
    55                 // Password is not hashed when creating new user.
    56                 $user_pass = md5($user_pass);
     57                //If this is a new user being created, we need to
     58                //use the phpass portable hash
     59                $hasher = new PasswordHash(8, TRUE);
     60                $user_pass = $hasher->HashPassword($user_pass);
    5761        }
    5862
    5963        $user_login = sanitize_user($user_login, true);
     
    154158        // If password is changing, hash it now.
    155159        if ( ! empty($userdata['user_pass']) ) {
    156160                $plaintext_pass = $userdata['user_pass'];
    157                 $userdata['user_pass'] = md5($userdata['user_pass']);
     161                //Use the new phpass portable hash
     162                $hasher = new PasswordHash(8, TRUE);
     163                $userdata['user_pass'] = $hasher->HashPassword($userdata['user_pass']);
    158164        }
    159165
    160166        // Merge old and new fields with new fields overwriting old ones.
     
    205211        return wp_create_user($username, $password, $email);
    206212}
    207213
    208 ?>
    209  No newline at end of file
     214?>
  • wp-includes/user.php

     
    11<?php
    22
     3include_once(ABSPATH . WPINC . '/class-phpass.php');
     4
    35function get_profile($field, $user = false) {
    46        global $wpdb;
    57        if ( !$user )
     
    1618// TODO: xmlrpc only.  Maybe move to xmlrpc.php.
    1719function user_pass_ok($user_login,$user_pass) {
    1820        $userdata = get_userdatabylogin($user_login);
    19 
    20         return (md5($user_pass) == $userdata->user_pass);
     21        if (strlen($userdata->user_pass) > 32) {
     22                //The hash is longer than MD5, so presume the new phpass portable hash
     23                //is being used.
     24                $hasher = new PasswordHash(8, TRUE);
     25                return($hasher->CheckPassword($user_pass, $userdata->user_pass));
     26        } else {
     27                return (md5($user_pass) == $userdata->user_pass);
     28        }
    2129}
    2230
    2331//