Changeset 35116 for trunk/src/wp-includes/user-functions.php

Timestamp:

10/13/2015 02:47:09 AM (10 years ago)

Author:

wonderboymusic

Message:

Users: when passing a WP_User instance to wp_update_user(), ensure that the user password is not accidentally double-hashed. This is terrifying.

Adds unit tests.

Props tbcorr, salcode.
Fixes #28435.

File:

• trunk/src/wp-includes/user-functions.php (modified) (1 diff)

trunk/src/wp-includes/user-functions.php

@@ -1603 +1603 @@
     $user = add_magic_quotes( $user );
 
-    if ( ! empty($userdata['user_pass']) ) {
+    if ( ! empty( $userdata['user_pass'] ) && $userdata['user_pass'] !== $user_obj->user_pass ) {
         // If password is changing, hash it now
         $plaintext_pass = $userdata['user_pass'];