Ticket #24973: 24973.diff

src/wp-includes/pluggable.php

@@ -1456 +1456 @@
                 $wp_hasher = new PasswordHash(8, true);
         }
 
-        return $wp_hasher->HashPassword($password);
+        return $wp_hasher->HashPassword( trim( $password ) );
 }
 endif;
 
@@ -1603 +1603 @@
 function wp_set_password( $password, $user_id ) {
         global $wpdb;
 
-        $hash = wp_hash_password( trim( $password ) );
+        $hash = wp_hash_password( $password );
         $wpdb->update($wpdb->users, array('user_pass' => $hash, 'user_activation_key' => ''), array('ID' => $user_id) );
 
         wp_cache_delete($user_id, 'users');

tests/phpunit/tests/auth.php

@@ -65 +65 @@
                         $this->assertEquals( $another_user, $authed_user->ID );
                 }
         }
+
+        /*
+         * @ticket 24973
+         */
+        function test_password_hash_trimming() {
+                $passwords_to_test = array(
+                        'a password with no trailing or leading spaces',
+                        'a password with trailing spaces ',
+                        ' a password with leading spaces',
+                        ' a password with trailing and leading spaces ',
+                );
+
+                foreach ( $passwords_to_test as $password_to_test ) {
+                        $password_hashed = wp_hash_password( $password_to_test );
+                        $password_check = wp_check_password( trim( $password_to_test ), $password_hashed );
+
+                        $this->assertTrue( $password_check );
+                }
+        }
 }