Changeset 28054

Timestamp:

04/08/2014 06:06:40 PM (10 years ago)

Author:

nacin

Message:

Harden HMAC verification. props duck_. [28053] for 3.8.

Location:

branches/3.8

Files:

• . (modified) (1 prop)
• src/wp-includes/pluggable.php (modified) (1 diff)

branches/3.8/src/wp-includes/pluggable.php

@@ -544 +544 @@
     $hash = hash_hmac('md5', $username . '|' . $expiration, $key);
 
-    if ( $hmac != $hash ) {
+    if ( hash_hmac( 'md5', $hmac, $key ) !== hash_hmac( 'md5', $hash, $key ) ) {
         do_action('auth_cookie_bad_hash', $cookie_elements);
         return false;