Changeset 43367

Timestamp:

06/16/2018 02:09:58 PM (6 years ago)

Author:

johnbillion

Message:

Security: Harden the random aspect of the hash used for user profile and admin email address changes.

Props BjornW

Fixes #43771

Location:

trunk/src

Files:

• wp-admin/includes/misc.php (modified) (1 diff)
• wp-includes/user.php (modified) (1 diff)

trunk/src/wp-admin/includes/misc.php

@@ -1206 +1206 @@
     }
 
-    $hash            = md5( $value . time() . mt_rand() );
+    $hash            = md5( $value . time() . wp_rand() );
     $new_admin_email = array(
         'hash'     => $hash,

trunk/src/wp-includes/user.php

@@ -2727 +2727 @@
         }
 
-        $hash           = md5( $_POST['email'] . time() . mt_rand() );
+        $hash           = md5( $_POST['email'] . time() . wp_rand() );
         $new_user_email = array(
             'hash'     => $hash,