Changeset 29751

Timestamp:

09/20/2014 05:27:46 PM (12 years ago)

Author:

nacin

Message:

Add safeguards for when ext/hash is not compiled with PHP.

see #29518, for trunk.

Location:

trunk/src/wp-includes

Files:

• pluggable.php (modified) (2 diffs)
• session.php (modified) (1 diff)

trunk/src/wp-includes/pluggable.php

@@ -670 +670 @@
 
         $key = wp_hash( $username . '|' . $pass_frag . '|' . $expiration . '|' . $token, $scheme );
-        $hash = hash_hmac( 'sha256', $username . '|' . $expiration . '|' . $token, $key );
+
+        // If ext/hash is not present, compat.php's hash_hmac() does not support sha256.
+        $algo = function_exists( 'hash' ) ? 'sha256' : 'sha1';
+        $hash = hash_hmac( $algo, $username . '|' . $expiration . '|' . $token, $key );
 
         if ( ! hash_equals( $hash, $hmac ) ) {
@@ -735 +738 @@
 
         $key = wp_hash( $user->user_login . '|' . $pass_frag . '|' . $expiration . '|' . $token, $scheme );
-        $hash = hash_hmac( 'sha256', $user->user_login . '|' . $expiration . '|' . $token, $key );
+
+        // If ext/hash is not present, compat.php's hash_hmac() does not support sha256.
+        $algo = function_exists( 'hash' ) ? 'sha256' : 'sha1';
+        $hash = hash_hmac( $algo, $user->user_login . '|' . $expiration . '|' . $token, $key );
 
         $cookie = $user->user_login . '|' . $expiration . '|' . $token . '|' . $hash;

trunk/src/wp-includes/session.php

@@ -62 +62 @@
          */
         final private function hash_token( $token ) {
-                return hash( 'sha256', $token );
+                // If ext/hash is not present, use sha1() instead.
+                if ( function_exists( 'hash' ) ) {
+                        return hash( 'sha256', $token );
+                } else {
+                        return sha1( $token );
+                }
         }