Changeset 19728 for trunk/wp-includes/post-template.php

Timestamp:

01/11/2012 04:42:42 PM (13 years ago)

Author:

ryan

Message:

Hash post password in cookies. fixes #19797

File:

• trunk/wp-includes/post-template.php (modified) (1 diff)

trunk/wp-includes/post-template.php

@@ -559 +559 @@
  */
 function post_password_required( $post = null ) {
+    global $wp_hasher;
+
     $post = get_post($post);
 
-    if ( empty($post->post_password) )
+    if ( empty( $post->post_password ) )
         return false;
 
-    if ( !isset($_COOKIE['wp-postpass_' . COOKIEHASH]) )
+    if ( ! isset( $_COOKIE['wp-postpass_' . COOKIEHASH] ) )
         return true;
 
-    if ( stripslashes( $_COOKIE['wp-postpass_' . COOKIEHASH] ) != $post->post_password )
-        return true;
-
-    return false;
+    if ( empty( $wp_hasher ) ) {
+        require_once( ABSPATH . 'wp-includes/class-phpass.php');
+        // By default, use the portable hash from phpass
+        $wp_hasher = new PasswordHash(8, true);
+    }
+
+    $hash = stripslashes( $_COOKIE[ 'wp-postpass_' . COOKIEHASH ] );
+
+    return ! $wp_hasher->CheckPassword( $post->post_password, $hash );
 }