Changeset 3810

Timestamp:

05/31/2006 12:24:03 AM (20 years ago)

Author:

ryan

Message:

wp_hash() and server secret.

Location:

trunk

Files:

• wp-admin/upgrade-schema.php (modified) (1 diff)
• wp-includes/cache.php (modified) (4 diffs)
• wp-includes/pluggable-functions.php (modified) (2 diffs)
• wp-includes/version.php (modified) (1 diff)

trunk/wp-admin/upgrade-schema.php

@@ -225 +225 @@
                 add_option('upload_path', 'wp-content/uploads');
         }
+        
+        // 2.0.3
+        add_option('secret', md5(uniqid(microtime())));
+
         // 2.1
         add_option('blog_public', 1);

trunk/wp-includes/cache.php

@@ -143 +143 @@
                 }
 
-                $cache_file = $this->cache_dir.$this->get_group_dir($group)."/".md5($id.DB_PASSWORD).'.php';
+                $cache_file = $this->cache_dir.$this->get_group_dir($group)."/".$this->hash($id).'.php';
                 if (!file_exists($cache_file)) {
                         $this->non_existant_objects[$group][$id] = true;
@@ -172 +172 @@
 
                 return "{$this->blog_id}/$group";
+        }
+
+        function hash($data) {
+                global $wp_server_secret;
+                if ( empty($wp_server_secret) )
+                        $wp_server_secret = DB_PASSWORD;
+
+                if ( function_exists('hash_hmac') ) {
+                        return hash_hmac('md5', $data, $wp_server_secret);
+                } else {
+                        return md5($data . $wp_server_secret);
+                }
         }
 
@@ -323 +335 @@
                         $ids = array_unique($ids);
                         foreach ($ids as $id) {
-                                $cache_file = $group_dir.md5($id.DB_PASSWORD).'.php';
+                                $cache_file = $group_dir.$this->hash($id).'.php';
 
                                 // Remove the cache file if the key is not set.
@@ -415 +427 @@
                         $this->expiration_time = CACHE_EXPIRATION_TIME;
 
-                $this->blog_id = md5($blog_id);
+                $this->blog_id = $this->hash($blog_id);
         }
 }

trunk/wp-includes/pluggable-functions.php

@@ -492 +492 @@
 
         //Allow for expanding range, but only do one check if we can
-        if( substr(md5($i . DB_PASSWORD . $action . $uid), -12, 10) == $nonce || substr(md5(($i - 1) . DB_PASSWORD . $action . $uid), -12, 10) == $nonce )
+        if( substr(wp_hash($i . $action . $uid), -12, 10) == $nonce || substr(wp_hash(($i - 1) . $action . $uid), -12, 10) == $nonce )
                 return true;
         return false;
@@ -505 +505 @@
         $i = ceil(time() / 43200);
         
-        return substr(md5($i . DB_PASSWORD . $action . $uid), -12, 10);
+        return substr(wp_hash($i . $action . $uid), -12, 10);
+}
+endif;
+
+if ( !function_exists('wp_hash') ) :
+function wp_hash($data) {
+        $secret = get_option('secret');
+        if ( empty($secret) )
+                $secret = DB_PASSWORD;
+
+        if ( function_exists('hash_hmac') ) {
+                return hash_hmac('md5', $data, $secret);
+        } else {
+                return md5($data . $secret);
+        }
 }
 endif;

trunk/wp-includes/version.php

@@ -4 +4 @@
 
 $wp_version = '2.1-alpha1';
-$wp_db_version = 3797;
+$wp_db_version = 3809;
 
 ?>