Changeset 30466 for trunk/src/wp-includes/class-phpass.php

Timestamp:

11/20/2014 04:02:55 PM (10 years ago)

Author:

nacin

Message:

Prevent high resource usage when hashing large passwords. props mdawaffe, pento

File:

• trunk/src/wp-includes/class-phpass.php (modified) (2 diffs)

trunk/src/wp-includes/class-phpass.php

@@ -215 +215 @@
     function HashPassword($password)
     {
+        if ( strlen( $password ) > 4096 ) {
+            return '*';
+        }
+
         $random = '';
 
@@ -250 +254 @@
     function CheckPassword($password, $stored_hash)
     {
+        if ( strlen( $password ) > 4096 ) {
+            return false;
+        }
+
         $hash = $this->crypt_private($password, $stored_hash);
         if ($hash[0] == '*')