Changeset 54379

Timestamp:

10/04/2022 03:57:29 AM (2 years ago)

Author:

peterwilsoncc

Message:

Security: Additional translations of salt default phrase.

Translate the default salt value "put your unique phrase here" in additional locations in which it is used. This further ensures that the default phrase is considered an error in non-english translations of wp-config.php.

Follow-up to [54249].

Props peterwilsoncc, audrasjb, JeffPaul.
Fixes #55937.

Location:

trunk/src

Files:

• wp-admin/maint/repair.php (modified) (2 diffs)
• wp-includes/class-wp-recovery-mode-cookie-service.php (modified) (2 diffs)

trunk/src/wp-admin/maint/repair.php

@@ -38 +38 @@
     echo "</p><p><code>define('WP_ALLOW_REPAIR', true);</code></p>";
 
-    $default_key     = __( 'put your unique phrase here' );
+    $default_keys    = array_unique(
+        array(
+            'put your unique phrase here',
+            /*
+             * translators: This string should only be translated if wp-config-sample.php is localized.
+             * You can check the localized release package or
+             * https://i18n.svn.wordpress.org/<locale code>/branches/<wp version>/dist/wp-config-sample.php
+             */
+            __( 'put your unique phrase here' ),
+        )
+    );
     $missing_key     = false;
     $duplicated_keys = array();
@@ -52 +62 @@
     }
 
-    // If at least one key uses the default value, consider it duplicated.
-    if ( isset( $duplicated_keys[ $default_key ] ) ) {
-        $duplicated_keys[ $default_key ] = true;
+    // If at least one key uses a default value, consider it duplicated.
+    foreach ( $default_keys as $default_key ) {
+        if ( isset( $duplicated_keys[ $default_key ] ) ) {
+            $duplicated_keys[ $default_key ] = true;
+        }
     }
 

trunk/src/wp-includes/class-wp-recovery-mode-cookie-service.php

@@ -199 +199 @@
      */
     private function recovery_mode_hash( $data ) {
-        if ( ! defined( 'AUTH_KEY' ) || AUTH_KEY === __( 'put your unique phrase here' ) ) {
+        $default_keys = array_unique(
+            array(
+                'put your unique phrase here',
+                /*
+                 * translators: This string should only be translated if wp-config-sample.php is localized.
+                 * You can check the localized release package or
+                 * https://i18n.svn.wordpress.org/<locale code>/branches/<wp version>/dist/wp-config-sample.php
+                 */
+                __( 'put your unique phrase here' ),
+            )
+        );
+
+        if ( ! defined( 'AUTH_KEY' ) || in_array( AUTH_KEY, $default_keys, true ) ) {
             $auth_key = get_site_option( 'recovery_mode_auth_key' );
 
@@ -214 +226 @@
         }
 
-        if ( ! defined( 'AUTH_SALT' ) || AUTH_SALT === 'put your unique phrase here' || AUTH_SALT === $auth_key ) {
+        if ( ! defined( 'AUTH_SALT' ) || in_array( AUTH_SALT, $default_keys, true ) || AUTH_SALT === $auth_key ) {
             $auth_salt = get_site_option( 'recovery_mode_auth_salt' );