Changeset 59754 for trunk/src/wp-includes/user.php

Timestamp:

02/03/2025 07:50:50 PM (3 months ago)

Author:

johnbillion

Message:

Security: Add the SensitiveParameter attribute to sensitive parameters.

Values passed to parameters with this attribute will be redacted if present in a stack trace when using PHP 8.2 or later. This reduces the chance that passwords and security keys get accidentally exposed in debug logs and bug reports.

Props petitphp, TobiasBg, jrf, johnbillion.

Fixes #57304

File:

• trunk/src/wp-includes/user.php (modified) (8 diffs)

trunk/src/wp-includes/user.php

@@ -151 +151 @@
  * @return WP_User|WP_Error WP_User on success, WP_Error on failure.
  */
-function wp_authenticate_username_password( $user, $username, $password ) {
+function wp_authenticate_username_password(
+    $user,
+    $username,
+    #[\SensitiveParameter]
+    $password
+) {
     if ( $user instanceof WP_User ) {
         return $user;
@@ -229 +234 @@
  * @return WP_User|WP_Error WP_User on success, WP_Error on failure.
  */
-function wp_authenticate_email_password( $user, $email, $password ) {
+function wp_authenticate_email_password(
+    $user,
+    $email,
+    #[\SensitiveParameter]
+    $password
+) {
     if ( $user instanceof WP_User ) {
         return $user;
@@ -302 +312 @@
  * @return WP_User|WP_Error WP_User on success, WP_Error on failure.
  */
-function wp_authenticate_cookie( $user, $username, $password ) {
+function wp_authenticate_cookie(
+    $user,
+    $username,
+    #[\SensitiveParameter]
+    $password
+) {
     global $auth_secure_cookie;
 
@@ -343 +358 @@
  *                               null is passed in and this isn't an API request.
  */
-function wp_authenticate_application_password( $input_user, $username, $password ) {
+function wp_authenticate_application_password(
+    $input_user,
+    $username,
+    #[\SensitiveParameter]
+    $password
+) {
     if ( $input_user instanceof WP_User ) {
         return $input_user;
@@ -2847 +2867 @@
  *                      be created.
  */
-function wp_create_user( $username, $password, $email = '' ) {
+function wp_create_user(
+    $username,
+    #[\SensitiveParameter]
+    $password,
+    $email = ''
+) {
     $user_login = wp_slash( $username );
     $user_email = wp_slash( $email );
@@ -3035 +3060 @@
  * @return WP_User|WP_Error WP_User object on success, WP_Error object for invalid or expired keys.
  */
-function check_password_reset_key( $key, $login ) {
+function check_password_reset_key(
+    #[\SensitiveParameter]
+    $key,
+    $login
+) {
     global $wp_hasher;
 
@@ -3372 +3401 @@
  * @param string  $new_pass New password for the user in plaintext
  */
-function reset_password( $user, $new_pass ) {
+function reset_password(
+    $user,
+    #[\SensitiveParameter]
+    $new_pass
+) {
     /**
      * Fires before the user's password is reset.
@@ -4933 +4966 @@
  * @return true|WP_Error True on success, WP_Error on failure.
  */
-function wp_validate_user_request_key( $request_id, $key ) {
+function wp_validate_user_request_key(
+    $request_id,
+    #[\SensitiveParameter]
+    $key
+) {
     global $wp_hasher;