Changeset 54249

Timestamp:

09/20/2022 11:55:21 AM (4 years ago)

Author:

audrasjb

Message:

Security: Salting functions: translate the phrase "put your unique phrase here".

In wp_salt() WordPress pre-populates the check for duplicate salt values with the default put your unique phrase here. As the wp-config.php file for non-en_US can be translated in downloaded packages, a translated version of this phrase ought to be in the pre-populated duplicate values array too.

Props peterwilsoncc, SergeyBiryukov, whaze, costdev, audrasjb.
Fixes #55937.

Location:

trunk/src

Files:

• wp-admin/maint/repair.php (modified) (1 diff)
• wp-includes/class-wp-recovery-mode-cookie-service.php (modified) (1 diff)
• wp-includes/pluggable.php (modified) (1 diff)

trunk/src/wp-admin/maint/repair.php

@@ -38 +38 @@
         echo "</p><p><code>define('WP_ALLOW_REPAIR', true);</code></p>";
 
-        $default_key     = 'put your unique phrase here';
+        $default_key     = __( 'put your unique phrase here' );
         $missing_key     = false;
         $duplicated_keys = array();

trunk/src/wp-includes/class-wp-recovery-mode-cookie-service.php

@@ -199 +199 @@
          */
         private function recovery_mode_hash( $data ) {
-                if ( ! defined( 'AUTH_KEY' ) || AUTH_KEY === 'put your unique phrase here' ) {
+                if ( ! defined( 'AUTH_KEY' ) || AUTH_KEY === __( 'put your unique phrase here' ) ) {
                         $auth_key = get_site_option( 'recovery_mode_auth_key' );
 

trunk/src/wp-includes/pluggable.php

@@ -2409 +2409 @@
                 static $duplicated_keys;
                 if ( null === $duplicated_keys ) {
-                        $duplicated_keys = array( 'put your unique phrase here' => true );
+                        $duplicated_keys = array(
+                                'put your unique phrase here'       => true,
+                                /*
+                                 * translators: This string should only be translated if wp-config-sample.php is localized.
+                                 * You can check the localized release package or
+                                 * https://i18n.svn.wordpress.org/<locale code>/branches/<wp version>/dist/wp-config-sample.php
+                                 */
+                                __( 'put your unique phrase here' ) => true,
+                        );
                         foreach ( array( 'AUTH', 'SECURE_AUTH', 'LOGGED_IN', 'NONCE', 'SECRET' ) as $first ) {
                                 foreach ( array( 'KEY', 'SALT' ) as $second ) {