Changeset 19925

Timestamp:

02/14/2012 06:29:22 PM (13 years ago)

Author:

ryan

Message:

Set post password cookies via an action in wp-login.php. Retire wp-pass.php (one less root file). Obey login ssl preferences for post password form submission. Props SergeyBiryukov. fixes #19798

Location:

trunk

Files:

• wp-includes/post-template.php (modified) (1 diff)
• wp-login.php (modified) (2 diffs)
• wp-pass.php (deleted)

trunk/wp-includes/post-template.php

@@ -1221 +1221 @@
     global $post;
     $label = 'pwbox-' . ( empty($post->ID) ? rand() : $post->ID );
-    $output = '<form action="' . site_url('wp-pass.php') . '" method="post">
+    $output = '<form action="' . esc_url( site_url( 'wp-login.php?action=postpass', 'login_post' ) ) . '" method="post">
     <p>' . __("This post is password protected. To view it please enter your password below:") . '</p>
     <p><label for="' . $label . '">' . __("Password:") . ' <input name="post_password" id="' . $label . '" type="password" size="20" /></label> <input type="submit" name="Submit" value="' . esc_attr__("Submit") . '" /></p>

trunk/wp-login.php

@@ -351 +351 @@
 
 // validate action so as to default to the login screen
-if ( !in_array($action, array('logout', 'lostpassword', 'retrievepassword', 'resetpass', 'rp', 'register', 'login'), true) && false === has_filter('login_form_' . $action) )
+if ( !in_array( $action, array( 'postpass', 'logout', 'lostpassword', 'retrievepassword', 'resetpass', 'rp', 'register', 'login' ), true ) && false === has_filter( 'login_form_' . $action ) )
     $action = 'login';
 
@@ -378 +378 @@
 $http_post = ('POST' == $_SERVER['REQUEST_METHOD']);
 switch ($action) {
+
+case 'postpass' :
+    if ( empty( $wp_hasher ) ) {
+        require_once( ABSPATH . 'wp-includes/class-phpass.php' );
+        // By default, use the portable hash from phpass
+        $wp_hasher = new PasswordHash(8, true);
+    }
+
+    // 10 days
+    setcookie( 'wp-postpass_' . COOKIEHASH, $wp_hasher->HashPassword( stripslashes( $_POST['post_password'] ) ), time() + 864000, COOKIEPATH );
+
+    wp_safe_redirect( wp_get_referer() );
+    exit();
+
+break;
 
 case 'logout' :