Changeset 8696

Timestamp:

08/21/2008 12:08:25 AM (18 years ago)

Author:

ryan

Message:

Some cookie validation hooks. fixes #7440

File:

• trunk/wp-includes/pluggable.php (modified) (3 diffs)

trunk/wp-includes/pluggable.php

@@ -486 +486 @@
  */
 function wp_validate_auth_cookie($cookie = '', $scheme = 'auth') {
+        if ( ! $cookie_elements = wp_parse_auth_cookie($cookie, $scheme) ) {
+                do_action('auth_cookie_malformed', $cookie, $scheme);
+                return false;
+        }
+
+        extract($cookie_elements, EXTR_OVERWRITE);
+
+        $expired = $expiration;
+
+        // Allow a grace period for POST and AJAX requests
+        if ( defined('DOING_AJAX') || 'POST' == $_SERVER['REQUEST_METHOD'] )
+                $expired += 3600;
+
+        // Quick check to see if an honest cookie has expired
+        if ( $expired < time() ) {
+                do_action('auth_cookie_expired', $cookie_elements);
+                return false;
+        }
+
+        $key = wp_hash($username . '|' . $expiration, $scheme);
+        $hash = hash_hmac('md5', $username . '|' . $expiration, $key);
+
+        if ( $hmac != $hash ) {
+                do_action('auth_cookie_bad_hash', $cookie_elements);
+                return false;
+        }
+
+        $user = get_userdatabylogin($username);
+        if ( ! $user ) {
+                do_action('auth_cookie_bad_username', $cookie_elements);
+                return false;
+        }
+
+        do_action('auth_cookie_valid', $cookie_elements, $user);
+
+        return $user->ID;
+}
+endif;
+
+if ( !function_exists('wp_generate_auth_cookie') ) :
+/**
+ * Generate authentication cookie contents.
+ *
+ * @since 2.5
+ * @uses apply_filters() Calls 'auth_cookie' hook on $cookie contents, User ID
+ *              and expiration of cookie.
+ *
+ * @param int $user_id User ID
+ * @param int $expiration Cookie expiration in seconds
+ * @param string $scheme Optional. The cookie scheme to use: auth, secure_auth, or logged_in
+ * @return string Authentication cookie contents
+ */
+function wp_generate_auth_cookie($user_id, $expiration, $scheme = 'auth') {
+        $user = get_userdata($user_id);
+
+        $key = wp_hash($user->user_login . '|' . $expiration, $scheme);
+        $hash = hash_hmac('md5', $user->user_login . '|' . $expiration, $key);
+
+        $cookie = $user->user_login . '|' . $expiration . '|' . $hash;
+
+        return apply_filters('auth_cookie', $cookie, $user_id, $expiration, $scheme);
+}
+endif;
+
+if ( !function_exists('wp_parse_auth_cookie') ) :
+/**
+ * Parse a cookie into its components
+ *
+ * @since 2.7
+ *
+ * @param string $cookie
+ * @param string $scheme Optional. The cookie scheme to use: auth, secure_auth, or logged_in
+ * @return array Authentication cookie components
+ */
+function wp_parse_auth_cookie($cookie = '', $scheme = 'auth') {
         if ( empty($cookie) ) {
                 if ( is_ssl() ) {
@@ -506 +581 @@
         list($username, $expiration, $hmac) = $cookie_elements;
 
-        $expired = $expiration;
-
-        // Allow a grace period for POST and AJAX requests
-        if ( defined('DOING_AJAX') || 'POST' == $_SERVER['REQUEST_METHOD'] )
-                $expired += 3600;
-
-        // Quick check to see if an honest cookie has expired
-        if ( $expired < time() )
-                return false;
-
-        $key = wp_hash($username . '|' . $expiration, $scheme);
-        $hash = hash_hmac('md5', $username . '|' . $expiration, $key);
-
-        if ( $hmac != $hash )
-                return false;
-
-        $user = get_userdatabylogin($username);
-        if ( ! $user )
-                return false;
-
-        return $user->ID;
-}
-endif;
-
-if ( !function_exists('wp_generate_auth_cookie') ) :
-/**
- * Generate authentication cookie contents.
- *
- * @since 2.5
- * @uses apply_filters() Calls 'auth_cookie' hook on $cookie contents, User ID
- *              and expiration of cookie.
- *
- * @param int $user_id User ID
- * @param int $expiration Cookie expiration in seconds
- * @param string $scheme Optional. The cookie scheme to use: auth, secure_auth, or logged_in
- * @return string Authentication cookie contents
- */
-function wp_generate_auth_cookie($user_id, $expiration, $scheme = 'auth') {
-        $user = get_userdata($user_id);
-
-        $key = wp_hash($user->user_login . '|' . $expiration, $scheme);
-        $hash = hash_hmac('md5', $user->user_login . '|' . $expiration, $key);
-
-        $cookie = $user->user_login . '|' . $expiration . '|' . $hash;
-
-        return apply_filters('auth_cookie', $cookie, $user_id, $expiration, $scheme);
+        return compact('username', 'expiration', 'hmac', 'scheme');
 }
 endif;
@@ -608 +638 @@
  */
 function wp_clear_auth_cookie() {
+        do_action('clear_auth_cookie');
+
         setcookie(AUTH_COOKIE, ' ', time() - 31536000, ADMIN_COOKIE_PATH, COOKIE_DOMAIN);
         setcookie(SECURE_AUTH_COOKIE, ' ', time() - 31536000, ADMIN_COOKIE_PATH, COOKIE_DOMAIN);