Changeset 19728

Timestamp:

01/11/2012 04:42:42 PM (13 years ago)

Author:

ryan

Message:

Hash post password in cookies. fixes #19797

Location:

trunk

Files:

• wp-includes/post-template.php (modified) (1 diff)
• wp-pass.php (modified) (1 diff)

trunk/wp-includes/post-template.php

@@ -559 +559 @@
  */
 function post_password_required( $post = null ) {
+    global $wp_hasher;
+
     $post = get_post($post);
 
-    if ( empty($post->post_password) )
+    if ( empty( $post->post_password ) )
         return false;
 
-    if ( !isset($_COOKIE['wp-postpass_' . COOKIEHASH]) )
+    if ( ! isset( $_COOKIE['wp-postpass_' . COOKIEHASH] ) )
         return true;
 
-    if ( stripslashes( $_COOKIE['wp-postpass_' . COOKIEHASH] ) != $post->post_password )
-        return true;
-
-    return false;
+    if ( empty( $wp_hasher ) ) {
+        require_once( ABSPATH . 'wp-includes/class-phpass.php');
+        // By default, use the portable hash from phpass
+        $wp_hasher = new PasswordHash(8, true);
+    }
+
+    $hash = stripslashes( $_COOKIE[ 'wp-postpass_' . COOKIEHASH ] );
+
+    return ! $wp_hasher->CheckPassword( $post->post_password, $hash );
 }
 

trunk/wp-pass.php

@@ -8 +8 @@
 
 /** Make sure that the WordPress bootstrap has run before continuing. */
-require( dirname(__FILE__) . '/wp-load.php');
+require( dirname( __FILE__ ) . '/wp-load.php');
+
+if ( empty( $wp_hasher ) ) {
+    require_once( ABSPATH . 'wp-includes/class-phpass.php');
+    // By default, use the portable hash from phpass
+    $wp_hasher = new PasswordHash(8, true);
+}
 
 // 10 days
-setcookie('wp-postpass_' . COOKIEHASH, stripslashes( $_POST['post_password'] ), time() + 864000, COOKIEPATH);
+setcookie( 'wp-postpass_' . COOKIEHASH, $wp_hasher->HashPassword( stripslashes( $_POST['post_password'] ) ), time() + 864000, COOKIEPATH );
 
-wp_safe_redirect(wp_get_referer());
+wp_safe_redirect( wp_get_referer() );
 exit;