Changeset 13133

Timestamp:

02/14/2010 02:47:45 AM (15 years ago)

Author:

nacin

Message:

Fall back to wp_generate_password() in setup-config.php if HTTPS request for secret keys fails. Also use pretty link to secret-key API, see #12159

Location:

trunk

Files:

• wp-admin/setup-config.php (modified) (3 diffs)
• wp-config-sample.php (modified) (1 diff)
• wp-includes/pluggable.php (modified) (1 diff)

trunk/wp-admin/setup-config.php

@@ -16 +16 @@
  */
 define('WP_INSTALLING', true);
+
+/**
+ * We are blissfully unaware of anything.
+ */
+define('WP_SETUP_CONFIG', true);
 
 /**
@@ -180 +185 @@
     /**#@-*/
 
-    $secret_keys = wp_remote_get( 'https://api.wordpress.org/secret-key/1.1/?salt=1' );
-    if ( is_wp_error( $secret_keys ) )
-        $secret_keys = false;
-    else
+    $secret_keys = wp_remote_get( 'https://api.wordpress.org/secret-key/1.1/salt/' );
+    if ( is_wp_error( $secret_keys ) ) {
+        $secret_keys = array();
+        require_once( ABSPATH . WPINC . '/pluggable.php' );
+        for ( $i = 0; $i < 8; $i++ )
+            $secret_keys[] = wp_generate_password( 64 );
+    } else {
         $secret_keys = explode( "\n", wp_remote_retrieve_body( $secret_keys ) );
+        foreach ( $secret_keys as $k => $v )
+            $secret_keys[$k] = substr( $v, 28, 64 );
+    }
     $key = 0;
 
@@ -212 +223 @@
             case "define('LOGGED_I":
             case "define('NONCE_SA":
-                if ( $secret_keys )
-                    $configFile[$line_num] = str_replace('put your unique phrase here', substr( $secret_keys[$key++], 28, 64 ), $line );
+                $configFile[$line_num] = str_replace('put your unique phrase here', $secret_keys[$key++], $line );
                 break;
         }

trunk/wp-config-sample.php

@@ -38 +38 @@
  *
  * Change these to different unique phrases!
- * You can generate these using the {@link https://api.wordpress.org/secret-key/1.1/?salt=1 WordPress.org secret-key service}
+ * You can generate these using the {@link https://api.wordpress.org/secret-key/1.1/salt/ WordPress.org secret-key service}
  * You can change these at any point in time to invalidate all existing cookies. This will force all users to have to log in again.
  *

trunk/wp-includes/pluggable.php

@@ -1496 +1496 @@
     // 32(md5) + 40(sha1) + 40(sha1) / 8 = 14 random numbers from $rnd_value
     if ( strlen($rnd_value) < 8 ) {
-        $seed = get_transient('random_seed');
+        if ( defined( 'WP_SETUP_CONFIG' ) )
+            static $seed = '';
+        else
+            $seed = get_transient('random_seed');
         $rnd_value = md5( uniqid(microtime() . mt_rand(), true ) . $seed );
         $rnd_value .= sha1($rnd_value);
         $rnd_value .= sha1($rnd_value . $seed);
         $seed = md5($seed . $rnd_value);
-        set_transient('random_seed', $seed);
+        if ( ! defined( 'WP_SETUP_CONFIG' ) )
+            set_transient('random_seed', $seed);
     }