Changeset 59828 for trunk/src/wp-includes/class-wp-recovery-mode-key-service.php

Timestamp:

02/17/2025 11:22:33 AM (3 months ago)

Author:

johnbillion

Message:

Security: Switch to using bcrypt for hashing user passwords and BLAKE2b for hashing application passwords and security keys.

Passwords and security keys that were saved in prior versions of WordPress will continue to work. Each user's password will be opportunistically rehashed and resaved when they next subsequently log in using a valid password.

The following new functions have been introduced:

• wp_password_needs_rehash()
• wp_fast_hash()
• wp_verify_fast_hash()

The following new filters have been introduced:

• password_needs_rehash
• wp_hash_password_algorithm
• wp_hash_password_options

Props ayeshrajans, bgermann, dd32, deadduck169, desrosj, haozi, harrym, iandunn, jammycakes, joehoyle, johnbillion, mbijon, mojorob, mslavco, my1xt, nacin, otto42, paragoninitiativeenterprises, paulkevan, rmccue, ryanhellyer, scribu, swalkinshaw, synchro, th23, timothyblynjacobs, tomdxw, westi, xknown.

Additional thanks go to the Roots team, Soatok, Calvin Alkan, and Raphael Ahrens.

Fixes #21022, #44628

File:

• trunk/src/wp-includes/class-wp-recovery-mode-key-service.php (modified) (6 diffs)

trunk/src/wp-includes/class-wp-recovery-mode-key-service.php

@@ -38 +38 @@
      *
      * @since 5.2.0
-     *
-     * @global PasswordHash $wp_hasher Portable PHP password hashing framework instance.
+     * @since 6.8.0 The stored key is now hashed using wp_fast_hash() instead of phpass.
      *
      * @param string $token A token generated by {@see generate_recovery_mode_token()}.
@@ -45 +44 @@
      */
     public function generate_and_store_recovery_mode_key( $token ) {
-
-        global $wp_hasher;
-
         $key = wp_generate_password( 22, false );
-
-        if ( empty( $wp_hasher ) ) {
-            require_once ABSPATH . WPINC . '/class-phpass.php';
-            $wp_hasher = new PasswordHash( 8, true );
-        }
-
-        $hashed = $wp_hasher->HashPassword( $key );
 
         $records = $this->get_keys();
 
         $records[ $token ] = array(
-            'hashed_key' => $hashed,
+            'hashed_key' => wp_fast_hash( $key ),
             'created_at' => time(),
         );
@@ -86 +75 @@
      * @since 5.2.0
      *
-     * @global PasswordHash $wp_hasher Portable PHP password hashing framework instance.
-     *
      * @param string $token The token used when generating the given key.
-     * @param string $key   The unhashed key.
+     * @param string $key   The plain text key.
      * @param int    $ttl   Time in seconds for the key to be valid for.
      * @return true|WP_Error True on success, error object on failure.
      */
     public function validate_recovery_mode_key( $token, $key, $ttl ) {
-        global $wp_hasher;
-
         $records = $this->get_keys();
 
@@ -110 +95 @@
         }
 
-        if ( empty( $wp_hasher ) ) {
-            require_once ABSPATH . WPINC . '/class-phpass.php';
-            $wp_hasher = new PasswordHash( 8, true );
-        }
-
-        if ( ! $wp_hasher->CheckPassword( $key, $record['hashed_key'] ) ) {
+        if ( ! wp_verify_fast_hash( $key, $record['hashed_key'] ) ) {
             return new WP_Error( 'hash_mismatch', __( 'Invalid recovery key.' ) );
         }
@@ -170 +150 @@
      *
      * @since 5.2.0
+     * @since 6.8.0 Each key is now hashed using wp_fast_hash() instead of phpass.
+     *              Existing keys may still be hashed using phpass.
      *
-     * @return array Associative array of $token => $data pairs, where $data has keys 'hashed_key'
-     *               and 'created_at'.
+     * @return array {
+     *     Associative array of token => data pairs, where the data is an associative
+     *     array of information about the key.
+     *
+     *     @type array ...$0 {
+     *         Information about the key.
+     *
+     *         @type string $hashed_key The hashed value of the key.
+     *         @type int    $created_at The timestamp when the key was created.
+     *     }
+     * }
      */
     private function get_keys() {
@@ -182 +173 @@
      *
      * @since 5.2.0
+     * @since 6.8.0 Each key should now be hashed using wp_fast_hash() instead of phpass.
      *
-     * @param array $keys Associative array of $token => $data pairs, where $data has keys 'hashed_key'
-     *                    and 'created_at'.
+     * @param array $keys {
+     *     Associative array of token => data pairs, where the data is an associative
+     *     array of information about the key.
+     *
+     *     @type array ...$0 {
+     *         Information about the key.
+     *
+     *         @type string $hashed_key The hashed value of the key.
+     *         @type int    $created_at The timestamp when the key was created.
+     *     }
+     * }
      * @return bool True on success, false on failure.
      */