Changeset 6350

Timestamp:

12/02/2007 05:14:11 AM (17 years ago)

Author:

ryan

Message:

Hash passwords with phpass. Add wp_check_pasword() and wp_hash_password() functions. Props pishmishy. see #2394

Location:

trunk

Files:

• wp-includes/class-phpass.php (added)
• wp-includes/pluggable.php (modified) (3 diffs)
• wp-includes/registration.php (modified) (2 diffs)
• wp-includes/user.php (modified) (1 diff)
• wp-login.php (modified) (1 diff)

trunk/wp-includes/pluggable.php

@@ -308 +308 @@
 
     $login = get_userdatabylogin($username);
-    //$login = $wpdb->get_row("SELECT ID, user_login, user_pass FROM $wpdb->users WHERE user_login = '$username'");
-
-    if (!$login) {
+
+    if ( !$login || ($login->user_login != $username) ) {
         $error = __('<strong>ERROR</strong>: Invalid username.');
         return false;
+    }
+
+    // If the password is already_md5, it has been double hashed.
+    // Otherwise, it is plain text.
+    if ( !$already_md5 ) {
+        if ( wp_check_password($password, $login->user_pass) ) {
+            // If using old md5 password, rehash.
+            if ( strlen($login->user_pass) <= 32 ) {
+                $hash = wp_hash_password($password);
+                $wpdb->query("UPDATE $wpdb->users SET user_pass = '$hash', user_activation_key = '' WHERE ID = '$login->ID'");
+                wp_cache_delete($login->ID, 'users');
+            }
+
+            return true;
+        }
     } else {
-        // If the password is already_md5, it has been double hashed.
-        // Otherwise, it is plain text.
-        if ( ($already_md5 && md5($login->user_pass) == $password) || ($login->user_login == $username && $login->user_pass == md5($password)) ) {
+        if ( md5($login->user_pass) == $password )
             return true;
-        } else {
-            $error = __('<strong>ERROR</strong>: Incorrect password.');
-            return false;
-        }
-    }
+    }
+
+    $error = __('<strong>ERROR</strong>: Incorrect password.');
+    return false;
 }
 endif;
@@ -474 +485 @@
 if ( !function_exists('wp_setcookie') ) :
 function wp_setcookie($username, $password, $already_md5 = false, $home = '', $siteurl = '', $remember = false) {
-    if ( !$already_md5 )
-        $password = md5( md5($password) ); // Double hash the password in the cookie.
+    $user = get_userdatabylogin($username);
+    if ( !$already_md5) {
+        $password = md5($user->user_pass); // Double hash the password in the cookie.
+    }
 
     if ( empty($home) )
@@ -701 +714 @@
 endif;
 
+if ( !function_exists('wp_hash_password') ) :
+function wp_hash_password($password) {
+    global $wp_hasher;
+
+    if ( empty($wp_hasher) ) {
+        require_once( ABSPATH . 'wp-includes/class-phpass.php');
+        // By default, use the portable hash from phpass
+        $wp_hasher = new PasswordHash(8, TRUE);
+    }
+    
+    return $wp_hasher->HashPassword($password); 
+}
+endif;
+
+if ( !function_exists('wp_check_password') ) :
+function wp_check_password($password, $hash) {
+    global $wp_hasher;
+
+    if ( strlen($hash) <= 32 )
+        return ( $hash == md5($password) );
+
+    // If the stored hash is longer than an MD5, presume the
+    // new style phpass portable hash.
+    if ( empty($wp_hasher) ) {
+        require_once( ABSPATH . 'wp-includes/class-phpass.php');
+        // By default, use the portable hash from phpass
+        $wp_hasher = new PasswordHash(8, TRUE);
+    }
+
+    return $wp_hasher->CheckPassword($password, $hash);
+}
+endif;
+
 ?>

trunk/wp-includes/registration.php

@@ -55 +55 @@
     } else {
         $update = false;
-        // Password is not hashed when creating new user.
-        $user_pass = md5($user_pass);
+        // Hash the password
+        $user_pass = wp_hash_password($user_pass);
     }
 
@@ -157 +157 @@
     if ( ! empty($userdata['user_pass']) ) {
         $plaintext_pass = $userdata['user_pass'];
-        $userdata['user_pass'] = md5($userdata['user_pass']);
+        $userdata['user_pass'] = wp_hash_password($userdata['user_pass']);
     }
 

trunk/wp-includes/user.php

@@ -17 +17 @@
 function user_pass_ok($user_login,$user_pass) {
     $userdata = get_userdatabylogin($user_login);
-
-    return (md5($user_pass) == $userdata->user_pass);
+    return wp_check_password($user_pass, $userdata->user_pass);
 }
 

trunk/wp-login.php

@@ -185 +185 @@
     // Generate something random for a password... md5'ing current time with a rand salt
     $new_pass = substr( md5( uniqid( microtime() ) ), 0, 7);
-    $wpdb->query("UPDATE $wpdb->users SET user_pass = MD5('$new_pass'), user_activation_key = '' WHERE user_login = '$user->user_login'");
+    $new_hash = wp_hash_password($new_pass); 
+    $wpdb->query("UPDATE $wpdb->users SET user_pass = '$new_hash', user_activation_key = '' WHERE ID = '$user->ID'");
     wp_cache_delete($user->ID, 'users');
-    wp_cache_delete($user->user_login, 'userlogins');
     $message  = sprintf(__('Username: %s'), $user->user_login) . "\r\n";
     $message .= sprintf(__('Password: %s'), $new_pass) . "\r\n";