Changeset 10486

Timestamp:

02/03/2009 05:03:16 AM (17 years ago)

Author:

ryan

Message:

Seed cookie hash key with a fragment from the password hash

File:

• trunk/wp-includes/pluggable.php (modified) (3 diffs)

trunk/wp-includes/pluggable.php

@@ -489 +489 @@
     }
 
-    $key = wp_hash($username . '|' . $expiration, $scheme);
-    $hash = hash_hmac('md5', $username . '|' . $expiration, $key);
-
-    if ( $hmac != $hash ) {
-        do_action('auth_cookie_bad_hash', $cookie_elements);
-        return false;
-    }
-
     $user = get_userdatabylogin($username);
     if ( ! $user ) {
@@ -503 +495 @@
     }
 
+    $pass_frag = substr($user->user_pass, 8, 4);
+
+    $key = wp_hash($username . $pass_frag . '|' . $expiration, $scheme);
+    $hash = hash_hmac('md5', $username . '|' . $expiration, $key);
+
+    if ( $hmac != $hash ) {
+        do_action('auth_cookie_bad_hash', $cookie_elements);
+        return false;
+    }
+
     do_action('auth_cookie_valid', $cookie_elements, $user);
 
@@ -525 +527 @@
     $user = get_userdata($user_id);
 
-    $key = wp_hash($user->user_login . '|' . $expiration, $scheme);
+    $pass_frag = substr($user->user_pass, 8, 4);
+
+    $key = wp_hash($user->user_login . $pass_frag . '|' . $expiration, $scheme);
     $hash = hash_hmac('md5', $user->user_login . '|' . $expiration, $key);