Changeset 10486

Timestamp:

02/03/2009 05:03:16 AM (18 years ago)

Author:

ryan

Message:

Seed cookie hash key with a fragment from the password hash

File:

• trunk/wp-includes/pluggable.php (modified) (3 diffs)

trunk/wp-includes/pluggable.php

@@ -489 +489 @@
         }
 
-        $key = wp_hash($username . '|' . $expiration, $scheme);
-        $hash = hash_hmac('md5', $username . '|' . $expiration, $key);
-
-        if ( $hmac != $hash ) {
-                do_action('auth_cookie_bad_hash', $cookie_elements);
-                return false;
-        }
-
         $user = get_userdatabylogin($username);
         if ( ! $user ) {
@@ -503 +495 @@
         }
 
+        $pass_frag = substr($user->user_pass, 8, 4);
+
+        $key = wp_hash($username . $pass_frag . '|' . $expiration, $scheme);
+        $hash = hash_hmac('md5', $username . '|' . $expiration, $key);
+
+        if ( $hmac != $hash ) {
+                do_action('auth_cookie_bad_hash', $cookie_elements);
+                return false;
+        }
+
         do_action('auth_cookie_valid', $cookie_elements, $user);
 
@@ -525 +527 @@
         $user = get_userdata($user_id);
 
-        $key = wp_hash($user->user_login . '|' . $expiration, $scheme);
+        $pass_frag = substr($user->user_pass, 8, 4);
+
+        $key = wp_hash($user->user_login . $pass_frag . '|' . $expiration, $scheme);
         $hash = hash_hmac('md5', $user->user_login . '|' . $expiration, $key);