Changeset 29221 for trunk/src/wp-includes/pluggable.php

Timestamp:

07/18/2014 09:12:05 AM (12 years ago)

Author:

nacin

Message:

Tie cookies and nonces to user sessions so they may be invalidated upon logout.

Sessions are stored in usermeta via WP_User_Meta_Session_Tokens, which extends the abstract WP_Session_Tokens class. Extending WP_Session_Tokens can allow for alternative storage, such as a separate table or Redis.

Introduces some simple APIs for session listing and destruction, such as wp_get_active_sessions() and wp_destroy_all_sessions().

This invalidates all existing authentication cookies, as a new segment (the session token) has been added to them.

props duck_, nacin, mdawaffe.
see #20276.

File:

• trunk/src/wp-includes/pluggable.php (modified) (11 diffs)

trunk/src/wp-includes/pluggable.php

@@ -587 +587 @@
  */
 function wp_logout() {
+        wp_destroy_current_session();
         wp_clear_auth_cookie();
 
@@ -632 +633 @@
         $username = $cookie_elements['username'];
         $hmac = $cookie_elements['hmac'];
+        $token = $cookie_elements['token'];
         $expired = $expiration = $cookie_elements['expiration'];
 
@@ -667 +669 @@
         $pass_frag = substr($user->user_pass, 8, 4);
 
-        $key = wp_hash($username . $pass_frag . '|' . $expiration, $scheme);
-        $hash = hash_hmac('md5', $username . '|' . $expiration, $key);
-
-        if ( hash_hmac( 'md5', $hmac, $key ) !== hash_hmac( 'md5', $hash, $key ) ) {
+        $key = wp_hash( $username . '|' . $pass_frag . '|' . $expiration . '|' . $token, $scheme );
+        $hash = hash_hmac( 'sha256', $username . '|' . $expiration . '|' . $token, $key );
+
+        if ( hash_hmac( 'sha256', $hmac, $key ) !== hash_hmac( 'sha256', $hash, $key ) ) {
                 /**
                  * Fires if a bad authentication cookie hash is encountered.
@@ -682 +684 @@
         }
 
-        if ( $expiration < time() ) {// AJAX/POST grace period set above
+        $manager = WP_Session_Tokens::get_instance( $user->ID );
+        if ( ! $manager->verify_token( $token ) ) {
+                do_action( 'auth_cookie_bad_session_token', $cookie_elements );
+                return false;
+        }
+
+        // AJAX/POST grace period set above
+        if ( $expiration < time() ) {
                 $GLOBALS['login_grace_period'] = 1;
         }
@@ -709 +718 @@
  * @param int $expiration Cookie expiration in seconds
  * @param string $scheme Optional. The cookie scheme to use: auth, secure_auth, or logged_in
- * @return string Authentication cookie contents
- */
-function wp_generate_auth_cookie($user_id, $expiration, $scheme = 'auth') {
+ * @param string $token User's session token to use for this cookie
+ * @return string Authentication cookie contents. Empty string if user does not exist.
+ */
+function wp_generate_auth_cookie( $user_id, $expiration, $scheme = 'auth', $token = '' ) {
         $user = get_userdata($user_id);
+        if ( ! $user ) {
+                return '';
+        }
+
+        if ( ! $token ) {
+                $manager = WP_Session_Tokens::get_instance( $user_id );
+                $token = $manager->create_token( $expiration );
+        }
 
         $pass_frag = substr($user->user_pass, 8, 4);
 
-        $key = wp_hash($user->user_login . $pass_frag . '|' . $expiration, $scheme);
-        $hash = hash_hmac('md5', $user->user_login . '|' . $expiration, $key);
-
-        $cookie = $user->user_login . '|' . $expiration . '|' . $hash;
+        $key = wp_hash( $user->user_login . '|' . $pass_frag . '|' . $expiration . '|' . $token, $scheme );
+        $hash = hash_hmac( 'sha256', $user->user_login . '|' . $expiration . '|' . $token, $key );
+
+        $cookie = $user->user_login . '|' . $expiration . '|' . $token . '|' . $hash;
 
         /**
@@ -730 +748 @@
          * @param int    $expiration Authentication cookie expiration in seconds.
          * @param string $scheme     Cookie scheme used. Accepts 'auth', 'secure_auth', or 'logged_in'.
-         */
-        return apply_filters( 'auth_cookie', $cookie, $user_id, $expiration, $scheme );
+         * @param string $token      User's session token used.
+         */
+        return apply_filters( 'auth_cookie', $cookie, $user_id, $expiration, $scheme, $token );
 }
 endif;
@@ -773 +792 @@
 
         $cookie_elements = explode('|', $cookie);
-        if ( count($cookie_elements) != 3 )
+        if ( count( $cookie_elements ) !== 4 ) {
                 return false;
-
-        list($username, $expiration, $hmac) = $cookie_elements;
-
-        return compact('username', 'expiration', 'hmac', 'scheme');
+        }
+
+        list( $username, $expiration, $token, $hmac ) = $cookie_elements;
+
+        return compact( 'username', 'expiration', 'token', 'hmac', 'scheme' );
 }
 endif;
@@ -794 +814 @@
  * @param int $user_id User ID
  * @param bool $remember Whether to remember the user
+ * @param mixed $secure  Whether the admin cookies should only be sent over HTTPS.
+ *                       Default is_ssl().
  */
 function wp_set_auth_cookie($user_id, $remember = false, $secure = '') {
@@ -855 +877 @@
         }
 
-        $auth_cookie = wp_generate_auth_cookie($user_id, $expiration, $scheme);
-        $logged_in_cookie = wp_generate_auth_cookie($user_id, $expiration, 'logged_in');
+        $manager = WP_Session_Tokens::get_instance( $user_id );
+        $token = $manager->create_token( $expiration );
+
+        $auth_cookie = wp_generate_auth_cookie( $user_id, $expiration, $scheme, $token );
+        $logged_in_cookie = wp_generate_auth_cookie( $user_id, $expiration, 'logged_in', $token );
 
         /**
@@ -1683 +1708 @@
         }
 
+        $token = wp_get_session_token();
         $i = wp_nonce_tick();
 
         // Nonce generated 0-12 hours ago
-        if ( substr(wp_hash($i . $action . $uid, 'nonce'), -12, 10) === $nonce )
+        if ( $nonce === substr( wp_hash( $i . '|' . $action . '|' . $uid . '|' . $token, 'nonce'), -12, 10 ) ) {
                 return 1;
+        }
+
         // Nonce generated 12-24 hours ago
-        if ( substr(wp_hash(($i - 1) . $action . $uid, 'nonce'), -12, 10) === $nonce )
+        if ( $nonce === substr( wp_hash( ( $i - 1 ) . '|' . $action . '|' . $uid . '|' . $token, 'nonce' ), -12, 10 ) ) {
                 return 2;
+        }
+
         // Invalid nonce
         return false;
@@ -1713 +1743 @@
         }
 
+        $token = wp_get_session_token();
         $i = wp_nonce_tick();
 
-        return substr(wp_hash($i . $action . $uid, 'nonce'), -12, 10);
+        return substr( wp_hash( $i . '|' . $action . '|' . $uid . '|' . $token, 'nonce' ), -12, 10 );
 }
 endif;