Changeset 13026

Timestamp:

02/08/2010 06:15:44 PM (15 years ago)

Author:

ryan

Message:

Update keys and salts with random values from api.wordpress.org. Props nacin. see #12159

Location:

trunk

Files:

• wp-admin/setup-config.php (modified) (2 diffs)
• wp-config-sample.php (modified) (1 diff)

trunk/wp-admin/setup-config.php

@@ -169 +169 @@
         wp_die($wpdb->error->get_error_message());
 
+    require_once( ABSPATH . WPINC . '/plugin.php' );
+    require_once( ABSPATH . WPINC . '/http.php' );
+    wp_fix_server_vars();
+    /**#@+
+     * @ignore
+     */
+    function get_bloginfo() {
+        return 'http://' . $_SERVER['HTTP_HOST'] . str_replace( $_SERVER['PHP_SELF'], '/wp-admin/setup-config.php', '' );
+    }
+    /**#@-*/
+
+    $secret_keys = wp_remote_get( 'https://api.wordpress.org/secret-key/1.1/?salt=1' );
+    if ( is_wp_error( $secret_keys ) )
+        $secret_keys = false;
+    else
+        $secret_keys = explode( "\n", wp_remote_retrieve_body( $secret_keys ) );
+    $key = 0;
+
     foreach ($configFile as $line_num => $line) {
         switch (substr($line,0,16)) {
@@ -185 +203 @@
             case '$table_prefix  =':
                 $configFile[$line_num] = str_replace('wp_', $prefix, $line);
+                break;
+            case "define('AUTH_KEY":
+            case "define('SECURE_A":
+            case "define('LOGGED_I":
+            case "define('NONCE_KE":
+            case "define('AUTH_SAL":
+            case "define('SECURE_A":
+            case "define('LOGGED_I":
+            case "define('NONCE_SA":
+                if ( $secret_keys )
+                    $configFile[$line_num] = str_replace('put your unique phrase here', substr( $secret_keys[$key++], 27, 64 ), $line );
                 break;
         }

trunk/wp-config-sample.php

@@ -35 +35 @@
 
 /**#@+
- * Authentication Unique Keys.
+ * Authentication Unique Keys and Salts.
  *
  * Change these to different unique phrases!
- * You can generate these using the {@link https://api.wordpress.org/secret-key/1.1/ WordPress.org secret-key service}
+ * You can generate these using the {@link https://api.wordpress.org/secret-key/1.1/?salt=1 WordPress.org secret-key service}
  * You can change these at any point in time to invalidate all existing cookies. This will force all users to have to log in again.
  *
  * @since 2.6.0
  */
-define('AUTH_KEY', 'put your unique phrase here');
-define('SECURE_AUTH_KEY', 'put your unique phrase here');
-define('LOGGED_IN_KEY', 'put your unique phrase here');
-define('NONCE_KEY', 'put your unique phrase here');
+define('AUTH_KEY',         'put your unique phrase here');
+define('SECURE_AUTH_KEY',  'put your unique phrase here');
+define('LOGGED_IN_KEY',    'put your unique phrase here');
+define('NONCE_KEY',        'put your unique phrase here');
+define('AUTH_SALT',        'put your unique phrase here');
+define('SECURE_AUTH_SALT', 'put your unique phrase here');
+define('LOGGED_IN_SALT',   'put your unique phrase here');
+define('NONCE_SALT',       'put your unique phrase here');
+
 /**#@-*/