Changeset 59030 for trunk/src/wp-includes/class-phpass.php

Timestamp:

09/17/2024 09:06:30 PM (4 months ago)

Author:

desrosj

Message:

External Libraries: Update PHPass library.

This updates the PHPass library to version 0.5.4 while maintaining the adjustments introduced in [30466].

Props jrf.
Fixes #62058.

File:

• trunk/src/wp-includes/class-phpass.php (modified) (9 diffs)

trunk/src/wp-includes/class-phpass.php

@@ -11 +11 @@
 # Portable PHP password hashing framework.
 #
-# Version 0.5 / WordPress.
+# Version 0.5.4 / WordPress.
 #
 # Written by Solar Designer <solar at openwall.com> in 2004-2006 and placed in
@@ -52 +52 @@
         $this->itoa64 = './0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz';
 
-        if ($iteration_count_log2 < 4 || $iteration_count_log2 > 31)
+        if ($iteration_count_log2 < 4 || $iteration_count_log2 > 31) {
             $iteration_count_log2 = 8;
+        }
         $this->iteration_count_log2 = $iteration_count_log2;
 
@@ -59 +60 @@
 
         $this->random_state = microtime();
-        if (function_exists('getmypid'))
+        if (function_exists('getmypid')) {
             $this->random_state .= getmypid();
+        }
     }
 
@@ -97 +99 @@
             $value = ord($input[$i++]);
             $output .= $this->itoa64[$value & 0x3f];
-            if ($i < $count)
+            if ($i < $count) {
                 $value |= ord($input[$i]) << 8;
+            }
             $output .= $this->itoa64[($value >> 6) & 0x3f];
-            if ($i++ >= $count)
+            if ($i++ >= $count) {
                 break;
-            if ($i < $count)
+            }
+            if ($i < $count) {
                 $value |= ord($input[$i]) << 16;
+            }
             $output .= $this->itoa64[($value >> 12) & 0x3f];
-            if ($i++ >= $count)
+            if ($i++ >= $count) {
                 break;
+            }
             $output .= $this->itoa64[($value >> 18) & 0x3f];
         } while ($i < $count);
@@ -116 +122 @@
     {
         $output = '$P$';
-        $output .= $this->itoa64[min($this->iteration_count_log2 +
-            ((PHP_VERSION >= '5') ? 5 : 3), 30)];
+        $output .= $this->itoa64[min($this->iteration_count_log2 + 5,
+            30)];
         $output .= $this->encode64($input, 6);
 
@@ -126 +132 @@
     {
         $output = '*0';
-        if (substr($setting, 0, 2) === $output)
+        if (substr($setting, 0, 2) === $output) {
             $output = '*1';
+        }
 
         $id = substr($setting, 0, 3);
         # We use "$P$", phpBB3 uses "$H$" for the same thing
-        if ($id !== '$P$' && $id !== '$H$')
+        if ($id !== '$P$' && $id !== '$H$') {
             return $output;
+        }
 
         $count_log2 = strpos($this->itoa64, $setting[3]);
-        if ($count_log2 < 7 || $count_log2 > 30)
+        if ($count_log2 < 7 || $count_log2 > 30) {
             return $output;
+        }
 
         $count = 1 << $count_log2;
 
         $salt = substr($setting, 4, 8);
-        if (strlen($salt) !== 8)
+        if (strlen($salt) !== 8) {
             return $output;
+        }
 
         # We were kind of forced to use MD5 here since it's the only
@@ -175 +185 @@
         $output = '$2a$';
         $output .= chr((int)(ord('0') + $this->iteration_count_log2 / 10));
-        $output .= chr((ord('0') + $this->iteration_count_log2 % 10));
+        $output .= chr(ord('0') + $this->iteration_count_log2 % 10);
         $output .= '$';
 
@@ -214 +224 @@
             $hash =
                 crypt($password, $this->gensalt_blowfish($random));
-            if (strlen($hash) === 60)
+            if (strlen($hash) === 60) {
                 return $hash;
-        }
-
-        if (strlen($random) < 6)
+            }
+        }
+
+        if (strlen($random) < 6) {
             $random = $this->get_random_bytes(6);
+        }
         $hash =
             $this->crypt_private($password,
             $this->gensalt_private($random));
-        if (strlen($hash) === 34)
+        if (strlen($hash) === 34) {
             return $hash;
+        }
 
         # Returning '*' on error is safe here, but would _not_ be safe
@@ -239 +252 @@
 
         $hash = $this->crypt_private($password, $stored_hash);
-        if ($hash[0] === '*')
+        if ($hash[0] === '*') {
             $hash = crypt($password, $stored_hash);
+        }
 
         # This is not constant-time.  In order to keep the code simple,