Changeset 30467 for branches/4.0/src/wp-includes/class-phpass.php

Timestamp:

11/20/2014 04:04:26 PM (12 years ago)

Author:

nacin

Message:

Prevent high resource usage when hashing large passwords. props mdawaffe, pento

Merges [30466] to the 4.0 branch.

Location:

branches/4.0

Files:

• . (modified) (1 prop)
• src/wp-includes/class-phpass.php (modified) (2 diffs)

branches/4.0/src/wp-includes/class-phpass.php

@@ -215 +215 @@
         function HashPassword($password)
         {
+                if ( strlen( $password ) > 4096 ) {
+                        return '*';
+                }
+
                 $random = '';
 
@@ -250 +254 @@
         function CheckPassword($password, $stored_hash)
         {
+                if ( strlen( $password ) > 4096 ) {
+                        return false;
+                }
+
                 $hash = $this->crypt_private($password, $stored_hash);
                 if ($hash[0] == '*')