Ticket #24973: trim-password-2.diff

tests/phpunit/tests/auth.php

@@ -44 +44 @@
                 $this->assertEquals( false, wp_validate_auth_cookie( $cookie, 'bar' ) );
         }
 
-        /*
+        /**
          * @ticket 23494
          */
         function test_password_trimming() {
@@ -65 +65 @@
                         $this->assertEquals( $another_user, $authed_user->ID );
                 }
         }
+
+        /**
+         * Test wp_hash_password trims whitespace
+         * 
+         * This is similar to test_password_trimming but tests the "lower level" 
+         * wp_hash_password function
+         * 
+         * @group 24973
+         */
+        function test_wp_hash_password_trimming() {
+
+                $password = ' pass with leading whitespace';
+                $this->assertTrue( wp_check_password( 'pass with leading whitespace', wp_hash_password( $password ) ) );
+
+                $password = 'pass with trailing whitespace ';
+                $this->assertTrue( wp_check_password( 'pass with trailing whitespace', wp_hash_password( $password ) ) );
+
+                $password = ' pass with whitespace ';
+                $this->assertTrue( wp_check_password( 'pass with whitespace', wp_hash_password( $password ) ) );
+
+                $password = "pass with new line \n";
+                $this->assertTrue( wp_check_password( 'pass with new line', wp_hash_password( $password ) ) );
+
+                $password = "pass with vertial tab o_O\x0B";
+                $this->assertTrue( wp_check_password( 'pass with vertial tab o_O', wp_hash_password( $password ) ) );
+        }
 }

src/wp-includes/pluggable.php

@@ -1456 +1456 @@
                 $wp_hasher = new PasswordHash(8, true);
         }
 
-        return $wp_hasher->HashPassword($password);
+        return $wp_hasher->HashPassword(trim($password));
 }
 endif;
 
@@ -1603 +1603 @@
 function wp_set_password( $password, $user_id ) {
         global $wpdb;
 
-        $hash = wp_hash_password( trim( $password ) );
+        $hash = wp_hash_password( $password );
         $wpdb->update($wpdb->users, array('user_pass' => $hash, 'user_activation_key' => ''), array('ID' => $user_id) );
 
         wp_cache_delete($user_id, 'users');