WordPress.org

Make WordPress Core

Changeset 29751


Ignore:
Timestamp:
09/20/2014 05:27:46 PM (7 years ago)
Author:
nacin
Message:

Add safeguards for when ext/hash is not compiled with PHP.

see #29518, for trunk.

Location:
trunk/src/wp-includes
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • trunk/src/wp-includes/pluggable.php

    r29635 r29751  
    670670
    671671    $key = wp_hash( $username . '|' . $pass_frag . '|' . $expiration . '|' . $token, $scheme );
    672     $hash = hash_hmac( 'sha256', $username . '|' . $expiration . '|' . $token, $key );
     672
     673    // If ext/hash is not present, compat.php's hash_hmac() does not support sha256.
     674    $algo = function_exists( 'hash' ) ? 'sha256' : 'sha1';
     675    $hash = hash_hmac( $algo, $username . '|' . $expiration . '|' . $token, $key );
    673676
    674677    if ( ! hash_equals( $hash, $hmac ) ) {
     
    735738
    736739    $key = wp_hash( $user->user_login . '|' . $pass_frag . '|' . $expiration . '|' . $token, $scheme );
    737     $hash = hash_hmac( 'sha256', $user->user_login . '|' . $expiration . '|' . $token, $key );
     740
     741    // If ext/hash is not present, compat.php's hash_hmac() does not support sha256.
     742    $algo = function_exists( 'hash' ) ? 'sha256' : 'sha1';
     743    $hash = hash_hmac( $algo, $user->user_login . '|' . $expiration . '|' . $token, $key );
    738744
    739745    $cookie = $user->user_login . '|' . $expiration . '|' . $token . '|' . $hash;
  • trunk/src/wp-includes/session.php

    r29635 r29751  
    6262     */
    6363    final private function hash_token( $token ) {
    64         return hash( 'sha256', $token );
     64        // If ext/hash is not present, use sha1() instead.
     65        if ( function_exists( 'hash' ) ) {
     66            return hash( 'sha256', $token );
     67        } else {
     68            return sha1( $token );
     69        }
    6570    }
    6671
Note: See TracChangeset for help on using the changeset viewer.