WordPress.org

Make WordPress Core

Changeset 28053


Ignore:
Timestamp:
04/08/2014 06:05:42 PM (6 years ago)
Author:
nacin
Message:

Harden HMAC verification. props duck_.

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/src/wp-includes/pluggable.php

    r28007 r28053  
    648648    $hash = hash_hmac('md5', $username . '|' . $expiration, $key);
    649649
    650     if ( $hmac != $hash ) {
     650    if ( hash_hmac( 'md5', $hmac, $key ) !== hash_hmac( 'md5', $hash, $key ) ) {
    651651        /**
    652652         * Fires if a bad authentication cookie hash is encountered.
Note: See TracChangeset for help on using the changeset viewer.