Changeset 30414

Timestamp:

11/20/2014 12:01:29 PM (9 years ago)

Author:

nacin

Message:

Use hash_equals() for old md5 hashes.

Merges [30412] to the 3.9 branch.

Location:

branches/3.9

Files:

• . (modified) (1 prop)
• src/wp-includes/pluggable.php (modified) (1 diff)

branches/3.9/src/wp-includes/pluggable.php

@@ -1870 +1870 @@
     // If the hash is still md5...
     if ( strlen($hash) <= 32 ) {
-        $check = ( $hash == md5($password) );
+        $check = hash_equals( $hash, md5( $password ) );
         if ( $check && $user_id ) {
             // Rehash using new hash.