Changeset 55397

Timestamp:

02/21/2023 03:57:36 PM (4 years ago)

Author:

TimothyBlynJacobs

Message:

Recovery Mode: Use PasswordHash API directly when validating keys.

Previously, the wp_check_password function was used for validating keys, while the PasswordHash class was used for creating keys. This would prevent Recovery Mode from working on sites that provide a custom implementation for the wp_check_password pluggable function.

Props calvinalkan.
Fixes #56787.

File:

• trunk/src/wp-includes/class-wp-recovery-mode-key-service.php (modified) (3 diffs)

trunk/src/wp-includes/class-wp-recovery-mode-key-service.php

@@ -86 +86 @@
          * @since 5.2.0
          *
+         * @global PasswordHash $wp_hasher
+         *
          * @param string $token The token used when generating the given key.
          * @param string $key   The unhashed key.
@@ -92 +94 @@
          */
         public function validate_recovery_mode_key( $token, $key, $ttl ) {
+                global $wp_hasher;
 
                 $records = $this->get_keys();
@@ -107 +110 @@
                 }
 
-                if ( ! wp_check_password( $key, $record['hashed_key'] ) ) {
+                if ( empty( $wp_hasher ) ) {
+                        require_once ABSPATH . WPINC . '/class-phpass.php';
+                        $wp_hasher = new PasswordHash( 8, true );
+                }
+
+                if ( ! $wp_hasher->CheckPassword( $key, $record['hashed_key'] ) ) {
                         return new WP_Error( 'hash_mismatch', __( 'Invalid recovery key.' ) );
                 }