Changeset 3813

Timestamp:

05/31/2006 05:01:09 AM (20 years ago)

Author:

ryan

Message:

wp_hash(), wp_salt(), and server secret.

Location:

branches/2.0

Files:

• wp-admin/upgrade-schema.php (modified) (1 diff)
• wp-includes/cache.php (modified) (5 diffs)
• wp-includes/pluggable-functions.php (modified) (2 diffs)
• wp-includes/version.php (modified) (1 diff)

branches/2.0/wp-admin/upgrade-schema.php

@@ -230 +230 @@
         add_option('upload_path', 'wp-content/uploads');
     }
+    
+    // 2.0.3
+    add_option('secret', md5(uniqid(microtime())));
 
     // Delete unused options

branches/2.0/wp-includes/cache.php

@@ -65 +65 @@
     var $warm_cache_hits = 0;
     var $cache_misses = 0;
+    var $secret = '';
 
     function acquire_lock() {
@@ -143 +144 @@
         }
 
-        $cache_file = $this->cache_dir.$this->get_group_dir($group)."/".md5($id.DB_PASSWORD).'.php';
+        $cache_file = $this->cache_dir.$this->get_group_dir($group)."/".$this->hash($id).'.php';
         if (!file_exists($cache_file)) {
             $this->non_existant_objects[$group][$id] = true;
@@ -172 +173 @@
 
         return "{$this->blog_id}/$group";
+    }
+
+    function hash($data) {
+        if ( function_exists('hash_hmac') ) {
+            return hash_hmac('md5', $data, $this->secret);
+        } else {
+            return md5($data . $this->secret);
+        }
     }
 
@@ -333 +342 @@
             $ids = array_unique($ids);
             foreach ($ids as $id) {
-                $cache_file = $group_dir.md5($id.DB_PASSWORD).'.php';
+                $cache_file = $group_dir.$this->hash($id).'.php';
 
                 // Remove the cache file if the key is not set.
@@ -425 +434 @@
             $this->expiration_time = CACHE_EXPIRATION_TIME;
 
-        $this->blog_id = md5($blog_id);
+        if ( defined('WP_SECRET') )
+            $this->secret = WP_SECRET;
+        else
+            $this->secret = DB_PASSWORD . DB_USER . DB_NAME . DB_HOST . ABSPATH;
+
+        $this->blog_id = $this->hash($blog_id);
     }
 }

branches/2.0/wp-includes/pluggable-functions.php

@@ -489 +489 @@
 
     //Allow for expanding range, but only do one check if we can
-    if( substr(md5($i . DB_PASSWORD . $action . $uid), -12, 10) == $nonce || substr(md5(($i - 1) . DB_PASSWORD . $action . $uid), -12, 10) == $nonce )
+    if( substr(wp_hash($i . $action . $uid), -12, 10) == $nonce || substr(wp_hash(($i - 1) . $action . $uid), -12, 10) == $nonce )
         return true;
     return false;
@@ -502 +502 @@
     $i = ceil(time() / 43200);
     
-    return substr(md5($i . DB_PASSWORD . $action . $uid), -12, 10);
+    return substr(wp_hash($i . $action . $uid), -12, 10);
+}
+endif;
+
+if ( !function_exists('wp_salt') ) :
+function wp_salt() {
+    $salt = get_option('secret');
+    if ( empty($salt) )
+        $salt = DB_PASSWORD . DB_USER . DB_NAME . DB_HOST . ABSPATH;
+
+    return $salt;
+}
+endif;
+
+if ( !function_exists('wp_hash') ) :
+function wp_hash($data) {
+    $salt = wp_salt();
+
+    if ( function_exists('hash_hmac') ) {
+        return hash_hmac('md5', $data, $salt);
+    } else {
+        return md5($data . $salt);
+    }
 }
 endif;

branches/2.0/wp-includes/version.php

@@ -4 +4 @@
 
 $wp_version = '2.0.3-beta';
-$wp_db_version = 3796;
+$wp_db_version = 3310;
 
 ?>