Changeset 6471

Timestamp:

12/23/2007 12:58:06 AM (17 years ago)

Author:

ryan

Message:

Don't fallback to DB info for secret key. Allow expiration grace period for AJAX requests. see #5367

Location:

trunk

Files:

• wp-config-sample.php (modified) (1 diff)
• wp-includes/pluggable.php (modified) (3 diffs)

trunk/wp-config-sample.php

@@ -7 +7 @@
 define('DB_CHARSET', 'utf8');
 define('DB_COLLATE', '');
+
+// Change SECRET_KEY to a unique phrase.  You won't have to remember it later,
+// so make it long and complicated.  You can visit https://www.grc.com/passwords.htm
+// to get a phrase generated for you.
 define('SECRET_KEY', ''); // Change this to a unique phrase.
 

trunk/wp-includes/pluggable.php

@@ -337 +337 @@
     $expired = $expiration;
 
-    // Allow a grace period for POST requests
-    if ( 'POST' == $_SERVER['REQUEST_METHOD'] )
+    // Allow a grace period for POST and AJAX requests
+    if ( defined('DOING_AJAX') || 'POST' == $_SERVER['REQUEST_METHOD'] )
         $expired += 3600;
 
@@ -700 +700 @@
 if ( !function_exists('wp_salt') ) :
 function wp_salt() {
+
+    if ( defined('SECRET_KEY') && '' != SECRET_KEY )
+        return SECRET_KEY;
+
     $salt = get_option('secret');
     if ( empty($salt) ) {
@@ -706 +710 @@
     }
 
-    if ( !defined('SECRET_KEY') || '' == SECRET_KEY )
-        $secret_key = DB_PASSWORD . DB_USER . DB_NAME . DB_HOST . ABSPATH;
-    else
-        $secret_key = SECRET_KEY;
-        
-    return $salt . $secret_key;
+    return $salt;
 }
 endif;