Changeset 55397

Timestamp:

02/21/2023 03:57:36 PM (22 months ago)

Author:

TimothyBlynJacobs

Message:

Recovery Mode: Use PasswordHash API directly when validating keys.

Previously, the wp_check_password function was used for validating keys, while the PasswordHash class was used for creating keys. This would prevent Recovery Mode from working on sites that provide a custom implementation for the wp_check_password pluggable function.

Props calvinalkan.
Fixes #56787.

File:

• trunk/src/wp-includes/class-wp-recovery-mode-key-service.php (modified) (3 diffs)

trunk/src/wp-includes/class-wp-recovery-mode-key-service.php

@@ -86 +86 @@
      * @since 5.2.0
      *
+     * @global PasswordHash $wp_hasher
+     *
      * @param string $token The token used when generating the given key.
      * @param string $key   The unhashed key.
@@ -92 +94 @@
      */
     public function validate_recovery_mode_key( $token, $key, $ttl ) {
+        global $wp_hasher;
 
         $records = $this->get_keys();
@@ -107 +110 @@
         }
 
-        if ( ! wp_check_password( $key, $record['hashed_key'] ) ) {
+        if ( empty( $wp_hasher ) ) {
+            require_once ABSPATH . WPINC . '/class-phpass.php';
+            $wp_hasher = new PasswordHash( 8, true );
+        }
+
+        if ( ! $wp_hasher->CheckPassword( $key, $record['hashed_key'] ) ) {
             return new WP_Error( 'hash_mismatch', __( 'Invalid recovery key.' ) );
         }