Changeset 30412

Timestamp:

11/20/2014 11:48:11 AM (10 years ago)

Author:

nacin

Message:

Use hash_equals() for old md5 hashes.

File:

• trunk/src/wp-includes/pluggable.php (modified) (1 diff)

trunk/src/wp-includes/pluggable.php

@@ -1936 +1936 @@
     // If the hash is still md5...
     if ( strlen($hash) <= 32 ) {
-        $check = ( $hash == md5($password) );
+        $check = hash_equals( $hash, md5( $password ) );
         if ( $check && $user_id ) {
             // Rehash using new hash.