Changeset 29761

Timestamp:

09/23/2014 06:12:28 PM (10 years ago)

Author:

nacin

Message:

Add safeguards for when ext/hash is not compiled with PHP.

Merges [29751] to the 4.0 branch.

fixes #29518.

Location:

branches/4.0

Files:

• . (modified) (1 prop)
• src/wp-includes/pluggable.php (modified) (2 diffs)
• src/wp-includes/session.php (modified) (1 diff)

branches/4.0/src/wp-includes/pluggable.php

@@ -670 +670 @@
 
     $key = wp_hash( $username . '|' . $pass_frag . '|' . $expiration . '|' . $token, $scheme );
-    $hash = hash_hmac( 'sha256', $username . '|' . $expiration . '|' . $token, $key );
+
+    // If ext/hash is not present, compat.php's hash_hmac() does not support sha256.
+    $algo = function_exists( 'hash' ) ? 'sha256' : 'sha1';
+    $hash = hash_hmac( $algo, $username . '|' . $expiration . '|' . $token, $key );
 
     if ( ! hash_equals( $hash, $hmac ) ) {
@@ -735 +738 @@
 
     $key = wp_hash( $user->user_login . '|' . $pass_frag . '|' . $expiration . '|' . $token, $scheme );
-    $hash = hash_hmac( 'sha256', $user->user_login . '|' . $expiration . '|' . $token, $key );
+
+    // If ext/hash is not present, compat.php's hash_hmac() does not support sha256.
+    $algo = function_exists( 'hash' ) ? 'sha256' : 'sha1';
+    $hash = hash_hmac( $algo, $user->user_login . '|' . $expiration . '|' . $token, $key );
 
     $cookie = $user->user_login . '|' . $expiration . '|' . $token . '|' . $hash;

branches/4.0/src/wp-includes/session.php

@@ -62 +62 @@
      */
     final private function hash_token( $token ) {
-        return hash( 'sha256', $token );
+        // If ext/hash is not present, use sha1() instead.
+        if ( function_exists( 'hash' ) ) {
+            return hash( 'sha256', $token );
+        } else {
+            return sha1( $token );
+        }
     }