Changes from trunk/src/wp-includes/pluggable.php at r29635 to branches/4.0/src/wp-includes/pluggable.php at r30413

File:

• branches/4.0/src/wp-includes/pluggable.php (modified) (3 diffs)

branches/4.0/src/wp-includes/pluggable.php

@@ -670 +670 @@
 
     $key = wp_hash( $username . '|' . $pass_frag . '|' . $expiration . '|' . $token, $scheme );
-    $hash = hash_hmac( 'sha256', $username . '|' . $expiration . '|' . $token, $key );
+
+    // If ext/hash is not present, compat.php's hash_hmac() does not support sha256.
+    $algo = function_exists( 'hash' ) ? 'sha256' : 'sha1';
+    $hash = hash_hmac( $algo, $username . '|' . $expiration . '|' . $token, $key );
 
     if ( ! hash_equals( $hash, $hmac ) ) {
@@ -735 +738 @@
 
     $key = wp_hash( $user->user_login . '|' . $pass_frag . '|' . $expiration . '|' . $token, $scheme );
-    $hash = hash_hmac( 'sha256', $user->user_login . '|' . $expiration . '|' . $token, $key );
+
+    // If ext/hash is not present, compat.php's hash_hmac() does not support sha256.
+    $algo = function_exists( 'hash' ) ? 'sha256' : 'sha1';
+    $hash = hash_hmac( $algo, $user->user_login . '|' . $expiration . '|' . $token, $key );
 
     $cookie = $user->user_login . '|' . $expiration . '|' . $token . '|' . $hash;
@@ -1934 +1940 @@
     // If the hash is still md5...
     if ( strlen($hash) <= 32 ) {
-        $check = ( $hash == md5($password) );
+        $check = hash_equals( $hash, md5( $password ) );
         if ( $check && $user_id ) {
             // Rehash using new hash.