Changeset 30413

Timestamp:

11/20/2014 12:01:09 PM (10 years ago)

Author:

nacin

Message:

Use hash_equals() for old md5 hashes.

Merges [30412] to the 4.0 branch.

Location:

branches/4.0

Files:

• . (modified) (1 prop)
• src/wp-includes/pluggable.php (modified) (1 diff)

branches/4.0/src/wp-includes/pluggable.php

@@ -1940 +1940 @@
     // If the hash is still md5...
     if ( strlen($hash) <= 32 ) {
-        $check = ( $hash == md5($password) );
+        $check = hash_equals( $hash, md5( $password ) );
         if ( $check && $user_id ) {
             // Rehash using new hash.