Changeset 8696

Timestamp:

08/21/2008 12:08:25 AM (17 years ago)

Author:

ryan

Message:

Some cookie validation hooks. fixes #7440

File:

• trunk/wp-includes/pluggable.php (modified) (3 diffs)

trunk/wp-includes/pluggable.php

@@ -486 +486 @@
  */
 function wp_validate_auth_cookie($cookie = '', $scheme = 'auth') {
+    if ( ! $cookie_elements = wp_parse_auth_cookie($cookie, $scheme) ) {
+        do_action('auth_cookie_malformed', $cookie, $scheme);
+        return false;
+    }
+
+    extract($cookie_elements, EXTR_OVERWRITE);
+
+    $expired = $expiration;
+
+    // Allow a grace period for POST and AJAX requests
+    if ( defined('DOING_AJAX') || 'POST' == $_SERVER['REQUEST_METHOD'] )
+        $expired += 3600;
+
+    // Quick check to see if an honest cookie has expired
+    if ( $expired < time() ) {
+        do_action('auth_cookie_expired', $cookie_elements);
+        return false;
+    }
+
+    $key = wp_hash($username . '|' . $expiration, $scheme);
+    $hash = hash_hmac('md5', $username . '|' . $expiration, $key);
+
+    if ( $hmac != $hash ) {
+        do_action('auth_cookie_bad_hash', $cookie_elements);
+        return false;
+    }
+
+    $user = get_userdatabylogin($username);
+    if ( ! $user ) {
+        do_action('auth_cookie_bad_username', $cookie_elements);
+        return false;
+    }
+
+    do_action('auth_cookie_valid', $cookie_elements, $user);
+
+    return $user->ID;
+}
+endif;
+
+if ( !function_exists('wp_generate_auth_cookie') ) :
+/**
+ * Generate authentication cookie contents.
+ *
+ * @since 2.5
+ * @uses apply_filters() Calls 'auth_cookie' hook on $cookie contents, User ID
+ *      and expiration of cookie.
+ *
+ * @param int $user_id User ID
+ * @param int $expiration Cookie expiration in seconds
+ * @param string $scheme Optional. The cookie scheme to use: auth, secure_auth, or logged_in
+ * @return string Authentication cookie contents
+ */
+function wp_generate_auth_cookie($user_id, $expiration, $scheme = 'auth') {
+    $user = get_userdata($user_id);
+
+    $key = wp_hash($user->user_login . '|' . $expiration, $scheme);
+    $hash = hash_hmac('md5', $user->user_login . '|' . $expiration, $key);
+
+    $cookie = $user->user_login . '|' . $expiration . '|' . $hash;
+
+    return apply_filters('auth_cookie', $cookie, $user_id, $expiration, $scheme);
+}
+endif;
+
+if ( !function_exists('wp_parse_auth_cookie') ) :
+/**
+ * Parse a cookie into its components
+ *
+ * @since 2.7
+ *
+ * @param string $cookie
+ * @param string $scheme Optional. The cookie scheme to use: auth, secure_auth, or logged_in
+ * @return array Authentication cookie components
+ */
+function wp_parse_auth_cookie($cookie = '', $scheme = 'auth') {
     if ( empty($cookie) ) {
         if ( is_ssl() ) {
@@ -506 +581 @@
     list($username, $expiration, $hmac) = $cookie_elements;
 
-    $expired = $expiration;
-
-    // Allow a grace period for POST and AJAX requests
-    if ( defined('DOING_AJAX') || 'POST' == $_SERVER['REQUEST_METHOD'] )
-        $expired += 3600;
-
-    // Quick check to see if an honest cookie has expired
-    if ( $expired < time() )
-        return false;
-
-    $key = wp_hash($username . '|' . $expiration, $scheme);
-    $hash = hash_hmac('md5', $username . '|' . $expiration, $key);
-
-    if ( $hmac != $hash )
-        return false;
-
-    $user = get_userdatabylogin($username);
-    if ( ! $user )
-        return false;
-
-    return $user->ID;
-}
-endif;
-
-if ( !function_exists('wp_generate_auth_cookie') ) :
-/**
- * Generate authentication cookie contents.
- *
- * @since 2.5
- * @uses apply_filters() Calls 'auth_cookie' hook on $cookie contents, User ID
- *      and expiration of cookie.
- *
- * @param int $user_id User ID
- * @param int $expiration Cookie expiration in seconds
- * @param string $scheme Optional. The cookie scheme to use: auth, secure_auth, or logged_in
- * @return string Authentication cookie contents
- */
-function wp_generate_auth_cookie($user_id, $expiration, $scheme = 'auth') {
-    $user = get_userdata($user_id);
-
-    $key = wp_hash($user->user_login . '|' . $expiration, $scheme);
-    $hash = hash_hmac('md5', $user->user_login . '|' . $expiration, $key);
-
-    $cookie = $user->user_login . '|' . $expiration . '|' . $hash;
-
-    return apply_filters('auth_cookie', $cookie, $user_id, $expiration, $scheme);
+    return compact('username', 'expiration', 'hmac', 'scheme');
 }
 endif;
@@ -608 +638 @@
  */
 function wp_clear_auth_cookie() {
+    do_action('clear_auth_cookie');
+
     setcookie(AUTH_COOKIE, ' ', time() - 31536000, ADMIN_COOKIE_PATH, COOKIE_DOMAIN);
     setcookie(SECURE_AUTH_COOKIE, ' ', time() - 31536000, ADMIN_COOKIE_PATH, COOKIE_DOMAIN);