Changeset 13137

Timestamp:

02/14/2010 04:06:30 AM (15 years ago)

Author:

nacin

Message:

Use an expanded special character set when generating auth keys and salts via wp_generate_password(). Props sivel, see #12159

Location:

trunk

Files:

• wp-admin/includes/schema.php (modified) (1 diff)
• wp-admin/setup-config.php (modified) (1 diff)
• wp-includes/pluggable.php (modified) (5 diffs)

trunk/wp-admin/includes/schema.php

@@ -266 +266 @@
 
     // 2.0.3
-    'secret' => wp_generate_password(64),
+    'secret' => wp_generate_password( 64, true, true ),
 
     // 2.1

trunk/wp-admin/setup-config.php

@@ -190 +190 @@
         require_once( ABSPATH . WPINC . '/pluggable.php' );
         for ( $i = 0; $i < 8; $i++ )
-            $secret_keys[] = wp_generate_password( 64 );
+            $secret_keys[] = wp_generate_password( 64, true, true );
     } else {
         $secret_keys = explode( "\n", wp_remote_retrieve_body( $secret_keys ) );

trunk/wp-includes/pluggable.php

@@ -1309 +1309 @@
             $salt = get_option('auth_salt');
             if ( empty($salt) ) {
-                $salt = wp_generate_password(64);
+                $salt = wp_generate_password( 64, true, true );
                 update_option('auth_salt', $salt);
             }
@@ -1322 +1322 @@
             $salt = get_option('secure_auth_salt');
             if ( empty($salt) ) {
-                $salt = wp_generate_password(64);
+                $salt = wp_generate_password( 64, true, true );
                 update_option('secure_auth_salt', $salt);
             }
@@ -1335 +1335 @@
             $salt = get_option('logged_in_salt');
             if ( empty($salt) ) {
-                $salt = wp_generate_password(64);
+                $salt = wp_generate_password( 64, true, true );
                 update_option('logged_in_salt', $salt);
             }
@@ -1348 +1348 @@
             $salt = get_option('nonce_salt');
             if ( empty($salt) ) {
-                $salt = wp_generate_password(64);
+                $salt = wp_generate_password( 64, true, true );
                 update_option('nonce_salt', $salt);
             }
@@ -1462 +1462 @@
  *
  * @param int $length The length of password to generate
- * @param bool $special_chars Whether to include standard special characters
+ * @param bool $special_chars Whether to include standard special characters. Default true.
+ * @param bool $extra_special_chars Whether to include more special characters. Used
+ *   when generating secret keys and salts. Default false.
  * @return string The random password
  **/
-function wp_generate_password($length = 12, $special_chars = true) {
+function wp_generate_password( $length = 12, $special_chars = true, $extra_special_chars = false ) {
     $chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
-    if ( $special_chars )
+    if ( $special_chars ) {
         $chars .= '!@#$%^&*()';
+        if ( $extra_special_chars )
+            $chars .= '-_ []{}<>~`+=,.;:/?|';
+    }
 
     $password = '';