Changeset 59532 for trunk/src/wp-includes/link-template.php

Timestamp:

12/17/2024 11:56:28 PM (21 months ago)

Author:

SergeyBiryukov

Message:

Privacy: Use SHA-256 hashing algorithm for Gravatar.

This aims to improve privacy by switching to a more secure algorithm, as an MD5 string can be reversed.

Follow-up to [6748], [31107].

Props henry.wright, jucaduca, haozi, desrosj, dd32, SergeyBiryukov.
See #60638.

File:

• trunk/src/wp-includes/link-template.php (modified) (7 diffs)

trunk/src/wp-includes/link-template.php

@@ -4290 +4290 @@
  * @since 4.2.0
  *
- * @param mixed $id_or_email The avatar to retrieve a URL for. Accepts a user ID, Gravatar MD5 hash,
+ * @param mixed $id_or_email The avatar to retrieve a URL for. Accepts a user ID, Gravatar SHA-256 or MD5 hash,
  *                           user email, WP_User object, WP_Post object, or WP_Comment object.
  * @param array $args {
@@ -4354 +4354 @@
  * @since 4.2.0
  * @since 6.7.0 Gravatar URLs always use HTTPS.
- *
- * @param mixed $id_or_email The avatar to retrieve. Accepts a user ID, Gravatar MD5 hash,
+ * @since 6.8.0 Gravatar URLs use the SHA-256 hashing algorithm. 
+ *
+ * @param mixed $id_or_email The avatar to retrieve. Accepts a user ID, Gravatar SHA-256 or MD5 hash,
  *                           user email, WP_User object, WP_Post object, or WP_Comment object.
  * @param array $args {
@@ -4475 +4476 @@
          *
          * @param array $args        Arguments passed to get_avatar_data(), after processing.
-         * @param mixed $id_or_email The avatar to retrieve. Accepts a user ID, Gravatar MD5 hash,
+         * @param mixed $id_or_email The avatar to retrieve. Accepts a user ID, Gravatar SHA-256 or MD5 hash,
          *                           user email, WP_User object, WP_Post object, or WP_Comment object.
          */
@@ -4497 +4498 @@
                 $user = get_user_by( 'id', absint( $id_or_email ) );
         } elseif ( is_string( $id_or_email ) ) {
-                if ( str_contains( $id_or_email, '@md5.gravatar.com' ) ) {
+                if ( str_contains( $id_or_email, '@sha256.gravatar.com' ) ) {
+                        // SHA-256 hash.
+                        list( $email_hash ) = explode( '@', $id_or_email );
+                } else if ( str_contains( $id_or_email, '@md5.gravatar.com' ) ) {
                         // MD5 hash.
                         list( $email_hash ) = explode( '@', $id_or_email );
@@ -4531 +4535 @@
 
                 if ( $email ) {
-                        $email_hash = md5( strtolower( trim( $email ) ) );
+                        $email_hash = hash( 'sha256', strtolower( trim( $email ) ) );
                 }
         }
@@ -4565 +4569 @@
          *
          * @param string $url         The URL of the avatar.
-         * @param mixed  $id_or_email The avatar to retrieve. Accepts a user ID, Gravatar MD5 hash,
+         * @param mixed  $id_or_email The avatar to retrieve. Accepts a user ID, Gravatar SHA-256 or MD5 hash,
          *                            user email, WP_User object, WP_Post object, or WP_Comment object.
          * @param array  $args        Arguments passed to get_avatar_data(), after processing.
@@ -4577 +4581 @@
          *
          * @param array $args        Arguments passed to get_avatar_data(), after processing.
-         * @param mixed $id_or_email The avatar to retrieve. Accepts a user ID, Gravatar MD5 hash,
+         * @param mixed $id_or_email The avatar to retrieve. Accepts a user ID, Gravatar SHA-256 or MD5 hash,
          *                           user email, WP_User object, WP_Post object, or WP_Comment object.
          */