Changeset 59030

Timestamp:

09/17/2024 09:06:30 PM (2 years ago)

Author:

desrosj

Message:

External Libraries: Update PHPass library.

This updates the PHPass library to version 0.5.4 while maintaining the adjustments introduced in [30466].

Props jrf.
Fixes #62058.

File:

• trunk/src/wp-includes/class-phpass.php (modified) (9 diffs)

trunk/src/wp-includes/class-phpass.php

@@ -11 +11 @@
 # Portable PHP password hashing framework.
 #
-# Version 0.5 / WordPress.
+# Version 0.5.4 / WordPress.
 #
 # Written by Solar Designer <solar at openwall.com> in 2004-2006 and placed in
@@ -52 +52 @@
                 $this->itoa64 = './0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz';
 
-                if ($iteration_count_log2 < 4 || $iteration_count_log2 > 31)
+                if ($iteration_count_log2 < 4 || $iteration_count_log2 > 31) {
                         $iteration_count_log2 = 8;
+                }
                 $this->iteration_count_log2 = $iteration_count_log2;
 
@@ -59 +60 @@
 
                 $this->random_state = microtime();
-                if (function_exists('getmypid'))
+                if (function_exists('getmypid')) {
                         $this->random_state .= getmypid();
+                }
         }
 
@@ -97 +99 @@
                         $value = ord($input[$i++]);
                         $output .= $this->itoa64[$value & 0x3f];
-                        if ($i < $count)
+                        if ($i < $count) {
                                 $value |= ord($input[$i]) << 8;
+                        }
                         $output .= $this->itoa64[($value >> 6) & 0x3f];
-                        if ($i++ >= $count)
+                        if ($i++ >= $count) {
                                 break;
-                        if ($i < $count)
+                        }
+                        if ($i < $count) {
                                 $value |= ord($input[$i]) << 16;
+                        }
                         $output .= $this->itoa64[($value >> 12) & 0x3f];
-                        if ($i++ >= $count)
+                        if ($i++ >= $count) {
                                 break;
+                        }
                         $output .= $this->itoa64[($value >> 18) & 0x3f];
                 } while ($i < $count);
@@ -116 +122 @@
         {
                 $output = '$P$';
-                $output .= $this->itoa64[min($this->iteration_count_log2 +
-                        ((PHP_VERSION >= '5') ? 5 : 3), 30)];
+                $output .= $this->itoa64[min($this->iteration_count_log2 + 5,
+                    30)];
                 $output .= $this->encode64($input, 6);
 
@@ -126 +132 @@
         {
                 $output = '*0';
-                if (substr($setting, 0, 2) === $output)
+                if (substr($setting, 0, 2) === $output) {
                         $output = '*1';
+                }
 
                 $id = substr($setting, 0, 3);
                 # We use "$P$", phpBB3 uses "$H$" for the same thing
-                if ($id !== '$P$' && $id !== '$H$')
+                if ($id !== '$P$' && $id !== '$H$') {
                         return $output;
+                }
 
                 $count_log2 = strpos($this->itoa64, $setting[3]);
-                if ($count_log2 < 7 || $count_log2 > 30)
+                if ($count_log2 < 7 || $count_log2 > 30) {
                         return $output;
+                }
 
                 $count = 1 << $count_log2;
 
                 $salt = substr($setting, 4, 8);
-                if (strlen($salt) !== 8)
+                if (strlen($salt) !== 8) {
                         return $output;
+                }
 
                 # We were kind of forced to use MD5 here since it's the only
@@ -175 +185 @@
                 $output = '$2a$';
                 $output .= chr((int)(ord('0') + $this->iteration_count_log2 / 10));
-                $output .= chr((ord('0') + $this->iteration_count_log2 % 10));
+                $output .= chr(ord('0') + $this->iteration_count_log2 % 10);
                 $output .= '$';
 
@@ -214 +224 @@
                         $hash =
                             crypt($password, $this->gensalt_blowfish($random));
-                        if (strlen($hash) === 60)
+                        if (strlen($hash) === 60) {
                                 return $hash;
-                }
-
-                if (strlen($random) < 6)
+                        }
+                }
+
+                if (strlen($random) < 6) {
                         $random = $this->get_random_bytes(6);
+                }
                 $hash =
                     $this->crypt_private($password,
                     $this->gensalt_private($random));
-                if (strlen($hash) === 34)
+                if (strlen($hash) === 34) {
                         return $hash;
+                }
 
                 # Returning '*' on error is safe here, but would _not_ be safe
@@ -239 +252 @@
 
                 $hash = $this->crypt_private($password, $stored_hash);
-                if ($hash[0] === '*')
+                if ($hash[0] === '*') {
                         $hash = crypt($password, $stored_hash);
+                }
 
                 # This is not constant-time.  In order to keep the code simple,