WordPress.org

Make WordPress Core


Ignore:
File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/src/wp-includes/pluggable.php

    r30413 r29635  
    670670
    671671    $key = wp_hash( $username . '|' . $pass_frag . '|' . $expiration . '|' . $token, $scheme );
    672 
    673     // If ext/hash is not present, compat.php's hash_hmac() does not support sha256.
    674     $algo = function_exists( 'hash' ) ? 'sha256' : 'sha1';
    675     $hash = hash_hmac( $algo, $username . '|' . $expiration . '|' . $token, $key );
     672    $hash = hash_hmac( 'sha256', $username . '|' . $expiration . '|' . $token, $key );
    676673
    677674    if ( ! hash_equals( $hash, $hmac ) ) {
     
    738735
    739736    $key = wp_hash( $user->user_login . '|' . $pass_frag . '|' . $expiration . '|' . $token, $scheme );
    740 
    741     // If ext/hash is not present, compat.php's hash_hmac() does not support sha256.
    742     $algo = function_exists( 'hash' ) ? 'sha256' : 'sha1';
    743     $hash = hash_hmac( $algo, $user->user_login . '|' . $expiration . '|' . $token, $key );
     737    $hash = hash_hmac( 'sha256', $user->user_login . '|' . $expiration . '|' . $token, $key );
    744738
    745739    $cookie = $user->user_login . '|' . $expiration . '|' . $token . '|' . $hash;
     
    19401934    // If the hash is still md5...
    19411935    if ( strlen($hash) <= 32 ) {
    1942         $check = hash_equals( $hash, md5( $password ) );
     1936        $check = ( $hash == md5($password) );
    19431937        if ( $check && $user_id ) {
    19441938            // Rehash using new hash.
Note: See TracChangeset for help on using the changeset viewer.