Changeset 35116

Timestamp:

10/13/2015 02:47:09 AM (11 years ago)

Author:

wonderboymusic

Message:

Users: when passing a WP_User instance to wp_update_user(), ensure that the user password is not accidentally double-hashed. This is terrifying.

Adds unit tests.

Props tbcorr, salcode.
Fixes #28435.

Location:

trunk

Files:

• src/wp-includes/user-functions.php (modified) (1 diff)
• tests/phpunit/tests/user.php (modified) (1 diff)

trunk/src/wp-includes/user-functions.php

@@ -1603 +1603 @@
         $user = add_magic_quotes( $user );
 
-        if ( ! empty($userdata['user_pass']) ) {
+        if ( ! empty( $userdata['user_pass'] ) && $userdata['user_pass'] !== $user_obj->user_pass ) {
                 // If password is changing, hash it now
                 $plaintext_pass = $userdata['user_pass'];

trunk/tests/phpunit/tests/user.php

@@ -955 +955 @@
                 wp_new_user_notification( $user, 'this_is_deprecated' );
         }
+
+        /**
+         * @ticket 28435
+         */
+        function test_wp_update_user_no_change_pwd() {
+                $testuserid = 1;
+                $user = get_userdata( $testuserid );
+                $pwd_before = $user->user_pass;
+                wp_update_user( $user );
+                
+                // Reload the data
+                $pwd_after = get_userdata( $testuserid )->user_pass;
+                $this->assertEquals( $pwd_before, $pwd_after );
+        }
 }