Changeset 59803 for trunk/src/wp-includes/compat.php

Timestamp:

02/11/2025 11:12:03 AM (18 months ago)

Author:

johnbillion

Message:

Security: Explicitly require the hash PHP extension and add requirement checks during installation and upgrade.

This extension provides the hash() function and support for the SHA-256 algorithm, both of which are required for upcoming security related changes. This extension is almost universally enabled, however it is technically possible to disable it on PHP 7.2 and 7.3, hence the introduction of this requirement and the corresponding requirement checks prior to installing or upgrading WordPress.

Props peterwilsoncc, ayeshrajans, dd32, SergeyBiryukov, johnbillion.

Fixes #60638, #62815, #56017

See #21022

File:

• trunk/src/wp-includes/compat.php (modified) (1 diff)

trunk/src/wp-includes/compat.php

@@ -264 +264 @@
 }
 
-if ( ! function_exists( 'hash_hmac' ) ) :
-        /**
-         * Compat function to mimic hash_hmac().
-         *
-         * The Hash extension is bundled with PHP by default since PHP 5.1.2.
-         * However, the extension may be explicitly disabled on select servers.
-         * As of PHP 7.4.0, the Hash extension is a core PHP extension and can no
-         * longer be disabled.
-         * I.e. when PHP 7.4.0 becomes the minimum requirement, this polyfill
-         * and the associated `_hash_hmac()` function can be safely removed.
-         *
-         * @ignore
-         * @since 3.2.0
-         *
-         * @see _hash_hmac()
-         *
-         * @param string $algo   Hash algorithm. Accepts 'md5' or 'sha1'.
-         * @param string $data   Data to be hashed.
-         * @param string $key    Secret key to use for generating the hash.
-         * @param bool   $binary Optional. Whether to output raw binary data (true),
-         *                       or lowercase hexits (false). Default false.
-         * @return string|false The hash in output determined by `$binary`.
-         *                      False if `$algo` is unknown or invalid.
-         */
-        function hash_hmac( $algo, $data, $key, $binary = false ) {
-                return _hash_hmac( $algo, $data, $key, $binary );
-        }
-endif;
-
-/**
- * Internal compat function to mimic hash_hmac().
- *
- * @ignore
- * @since 3.2.0
- *
- * @param string $algo   Hash algorithm. Accepts 'md5' or 'sha1'.
- * @param string $data   Data to be hashed.
- * @param string $key    Secret key to use for generating the hash.
- * @param bool   $binary Optional. Whether to output raw binary data (true),
- *                       or lowercase hexits (false). Default false.
- * @return string|false The hash in output determined by `$binary`.
- *                      False if `$algo` is unknown or invalid.
- */
-function _hash_hmac( $algo, $data, $key, $binary = false ) {
-        $packs = array(
-                'md5'  => 'H32',
-                'sha1' => 'H40',
-        );
-
-        if ( ! isset( $packs[ $algo ] ) ) {
-                return false;
-        }
-
-        $pack = $packs[ $algo ];
-
-        if ( strlen( $key ) > 64 ) {
-                $key = pack( $pack, $algo( $key ) );
-        }
-
-        $key = str_pad( $key, 64, chr( 0 ) );
-
-        $ipad = ( substr( $key, 0, 64 ) ^ str_repeat( chr( 0x36 ), 64 ) );
-        $opad = ( substr( $key, 0, 64 ) ^ str_repeat( chr( 0x5C ), 64 ) );
-
-        $hmac = $algo( $opad . pack( $pack, $algo( $ipad . $data ) ) );
-
-        if ( $binary ) {
-                return pack( $pack, $hmac );
-        }
-
-        return $hmac;
-}
-
-if ( ! function_exists( 'hash_equals' ) ) :
-        /**
-         * Timing attack safe string comparison.
-         *
-         * Compares two strings using the same time whether they're equal or not.
-         *
-         * Note: It can leak the length of a string when arguments of differing length are supplied.
-         *
-         * This function was added in PHP 5.6.
-         * However, the Hash extension may be explicitly disabled on select servers.
-         * As of PHP 7.4.0, the Hash extension is a core PHP extension and can no
-         * longer be disabled.
-         * I.e. when PHP 7.4.0 becomes the minimum requirement, this polyfill
-         * can be safely removed.
-         *
-         * @since 3.9.2
-         *
-         * @param string $known_string Expected string.
-         * @param string $user_string  Actual, user supplied, string.
-         * @return bool Whether strings are equal.
-         */
-        function hash_equals( $known_string, $user_string ) {
-                $known_string_length = strlen( $known_string );
-
-                if ( strlen( $user_string ) !== $known_string_length ) {
-                        return false;
-                }
-
-                $result = 0;
-
-                // Do not attempt to "optimize" this.
-                for ( $i = 0; $i < $known_string_length; $i++ ) {
-                        $result |= ord( $known_string[ $i ] ) ^ ord( $user_string[ $i ] );
-                }
-
-                return 0 === $result;
-        }
-endif;
-
 // sodium_crypto_box() was introduced in PHP 7.2.
 if ( ! function_exists( 'sodium_crypto_box' ) ) {