Ticket #29518: 29518.2.diff

src/wp-includes/pluggable.php

@@ -669 +669 @@
         $pass_frag = substr($user->user_pass, 8, 4);
 
         $key = wp_hash( $username . '|' . $pass_frag . '|' . $expiration . '|' . $token, $scheme );
+        // Fall back to sha1 if ext/hash is unavailable.
+        $algo = function_exists( 'hash' ) ? 'sha256' : 'sha1';
         $hash = hash_hmac( 'sha256', $username . '|' . $expiration . '|' . $token, $key );
 
         if ( ! hash_equals( $hash, $hmac ) ) {
@@ -734 +736 @@
         $pass_frag = substr($user->user_pass, 8, 4);
 
         $key = wp_hash( $user->user_login . '|' . $pass_frag . '|' . $expiration . '|' . $token, $scheme );
+        // Fall back to sha1 if ext/hash is unavailable.
+        $algo = function_exists( 'hash' ) ? 'sha256' : 'sha1';
         $hash = hash_hmac( 'sha256', $user->user_login . '|' . $expiration . '|' . $token, $key );
 
         $cookie = $user->user_login . '|' . $expiration . '|' . $token . '|' . $hash;

src/wp-includes/session.php

@@ -61 +61 @@
          * @return string A hash of the session token (a verifier).
          */
         final private function hash_token( $token ) {
-                return hash( 'sha256', $token );
+                // Fall back to sha1 if ext/hash is unavailable.
+                if ( function_exists( 'hash' ) ) {
+                        return hash( 'sha256', $token );
+                } else {
+                        return sha1( $token );
+                }
         }
 
         /**