Changeset 29409

Timestamp:

08/06/2014 05:57:52 PM (9 years ago)

Author:

nacin

Message:

Use delimiters when building nonce hashes. Part two of [29386].

Location:

branches/3.8

Files:

• . (modified) (1 prop)
• src/wp-includes/pluggable.php (modified) (3 diffs)

branches/3.8/src/wp-includes/pluggable.php

@@ -1343 +1343 @@
 
     // Nonce generated 0-12 hours ago
-    $expected = substr( wp_hash( $i . '|' . $action . '|' . $uid . '|' . $token, 'nonce'), -12, 10 );
+    $expected = substr( wp_hash( $i . '|' . $action . '|' . $uid, 'nonce'), -12, 10 );
     if ( hash_equals( $expected, $nonce ) ) {
         return 1;
@@ -1349 +1349 @@
 
     // Nonce generated 12-24 hours ago
-    $expected = substr( wp_hash( ( $i - 1 ) . '|' . $action . '|' . $uid . '|' . $token, 'nonce' ), -12, 10 );
+    $expected = substr( wp_hash( ( $i - 1 ) . '|' . $action . '|' . $uid, 'nonce' ), -12, 10 );
     if ( hash_equals( $expected, $nonce ) ) {
         return 2;
@@ -1376 +1376 @@
     $i = wp_nonce_tick();
 
-    return substr(wp_hash($i . $action . $uid, 'nonce'), -12, 10);
+    return substr(wp_hash($i . '|' . $action . '|' . $uid, 'nonce'), -12, 10);
 }
 endif;