Index: src/wp-includes/pluggable.php =================================================================== --- src/wp-includes/pluggable.php (revision 28607) +++ src/wp-includes/pluggable.php (working copy) @@ -586,6 +586,7 @@ * @since 2.5.0 */ function wp_logout() { + wp_destroy_current_session(); wp_clear_auth_cookie(); /** @@ -631,6 +632,7 @@ $scheme = $cookie_elements['scheme']; $username = $cookie_elements['username']; $hmac = $cookie_elements['hmac']; + $token = $cookie_elements['token']; $expired = $expiration = $cookie_elements['expiration']; // Allow a grace period for POST and AJAX requests @@ -666,8 +668,8 @@ $pass_frag = substr($user->user_pass, 8, 4); - $key = wp_hash($username . $pass_frag . '|' . $expiration, $scheme); - $hash = hash_hmac('md5', $username . '|' . $expiration, $key); + $key = wp_hash( $username . '|' . $pass_frag . '|' . $expiration . '|' . $token, $scheme ); + $hash = hash_hmac( 'md5', $username . '|' . $expiration . '|' . $token, $key ); if ( hash_hmac( 'md5', $hmac, $key ) !== hash_hmac( 'md5', $hash, $key ) ) { /** @@ -681,7 +683,12 @@ return false; } - if ( $expiration < time() ) {// AJAX/POST grace period set above + if ( ! wp_verify_session_token( $user->ID, $token ) ) { + do_action( 'auth_cookie_bad_session_token', $cookie_elements ); + return false; + } + + if ( $expiration < time() ) { // AJAX/POST grace period set above $GLOBALS['login_grace_period'] = 1; } @@ -708,17 +715,25 @@ * @param int $user_id User ID * @param int $expiration Cookie expiration in seconds * @param string $scheme Optional. The cookie scheme to use: auth, secure_auth, or logged_in - * @return string Authentication cookie contents + * @param string $token User's session token to use for this cookie + * @return string Authentication cookie contents. Empty string if user does not exist. */ -function wp_generate_auth_cookie($user_id, $expiration, $scheme = 'auth') { +function wp_generate_auth_cookie( $user_id, $expiration, $scheme = 'auth', $token = '' ) { $user = get_userdata($user_id); + if ( ! $user ) { + return ''; + } + if ( ! $token ) { + $token = wp_create_session_token( $user_id, $expiration ); + } + $pass_frag = substr($user->user_pass, 8, 4); - $key = wp_hash($user->user_login . $pass_frag . '|' . $expiration, $scheme); - $hash = hash_hmac('md5', $user->user_login . '|' . $expiration, $key); + $key = wp_hash( $user->user_login . '|' . $pass_frag . '|' . $expiration . '|' . $token, $scheme ); + $hash = hash_hmac( 'md5', $user->user_login . '|' . $expiration . '|' . $token, $key ); - $cookie = $user->user_login . '|' . $expiration . '|' . $hash; + $cookie = $user->user_login . '|' . $expiration . '|' . $token . '|' . $hash; /** * Filter the authentication cookie. @@ -772,12 +787,13 @@ } $cookie_elements = explode('|', $cookie); - if ( count($cookie_elements) != 3 ) + if ( count( $cookie_elements ) !== 4 ) { return false; + } - list($username, $expiration, $hmac) = $cookie_elements; + list( $username, $expiration, $token, $hmac ) = $cookie_elements; - return compact('username', 'expiration', 'hmac', 'scheme'); + return compact( 'username', 'expiration', 'token', 'hmac', 'scheme' ); } endif; @@ -793,6 +809,8 @@ * * @param int $user_id User ID * @param bool $remember Whether to remember the user + * @param mixed $secure Whether the admin cookies should only be sent over HTTPS. + * Default is_ssl(). */ function wp_set_auth_cookie($user_id, $remember = false, $secure = '') { if ( $remember ) { @@ -850,8 +868,9 @@ $scheme = 'auth'; } - $auth_cookie = wp_generate_auth_cookie($user_id, $expiration, $scheme); - $logged_in_cookie = wp_generate_auth_cookie($user_id, $expiration, 'logged_in'); + $token = wp_create_session_token( $user_id, $expiration ); + $auth_cookie = wp_generate_auth_cookie( $user_id, $expiration, $scheme, $token ); + $logged_in_cookie = wp_generate_auth_cookie( $user_id, $expiration, 'logged_in', $token ); /** * Fires immediately before the authentication cookie is set. @@ -1678,14 +1697,19 @@ $uid = apply_filters( 'nonce_user_logged_out', $uid, $action ); } + $token = wp_get_session_token(); $i = wp_nonce_tick(); // Nonce generated 0-12 hours ago - if ( substr(wp_hash($i . $action . $uid, 'nonce'), -12, 10) === $nonce ) + if ( $nonce === substr( wp_hash( $i . '|' . $action . '|' . $uid . '|' . $token, 'nonce'), -12, 10 ) ) { return 1; + } + // Nonce generated 12-24 hours ago - if ( substr(wp_hash(($i - 1) . $action . $uid, 'nonce'), -12, 10) === $nonce ) + if ( $nonce === substr( wp_hash( ( $i - 1 ) . '|' . $action . '|' . $uid . '|' . $token, 'nonce' ), -12, 10 ) ) { return 2; + } + // Invalid nonce return false; } @@ -1708,9 +1732,10 @@ $uid = apply_filters( 'nonce_user_logged_out', $uid, $action ); } + $token = wp_get_session_token(); $i = wp_nonce_tick(); - return substr(wp_hash($i . $action . $uid, 'nonce'), -12, 10); + return substr( wp_hash( $i . '|' . $action . '|' . $uid . '|' . $token, 'nonce' ), -12, 10 ); } endif; Index: src/wp-includes/user.php =================================================================== --- src/wp-includes/user.php (revision 28607) +++ src/wp-includes/user.php (working copy) @@ -2127,3 +2127,100 @@ return $user_id; } + +/** + * Generate a cookie session identification token. + * + * A session identification token is a long, random string. It is used to + * link a cookie to an expiration time and to ensure that cookies become + * invalidated upon logout. This function generates a token and stores it + * as user meta with the associated expiration time. + * + * Will also remove any expired tokens from the database. + * + * @since 4.0.0 + * + * @param int $user_id User to create a token for. + * @param int $expiration Session expiration timestamp. + * @return string Session identification token. + */ +function wp_create_session_token( $user_id, $expiration ) { + $sessions = get_user_meta( $user_id, 'session_tokens', true ); + if ( ! $sessions ) + $sessions = array(); + // Expire old sessions + $time = time(); + foreach ( $sessions as $v => $e ) { + if ( $e < $time ) { + unset( $sessions[ $v ] ); + } + } + + $token = wp_generate_password( 40, false, false ); + $verifier = hash( 'sha256', $token ); + $sessions[ $verifier ] = $expiration; + + update_user_meta( $user_id, 'session_tokens', $sessions ); + + return $token; +} + +/** + * Validate a user's session token as authentic. + * + * Checks that the given token is present in the database and hasn't expired. + * + * @since 4.0.0 + * + * @param int $user_id User to verify against. + * @param string $token Token to verify. + * @return bool Whether the token is valid for the given user. + */ +function wp_verify_session_token( $user_id, $token ) { + $sessions = get_user_meta( $user_id, 'session_tokens', true ); + $verifier = hash( 'sha256', $token ); + return isset( $sessions[ $verifier ] ) && $sessions[ $verifier ] >= time(); +} + +/** + * Remove the current session token from the database. + * + * Will also remove any expired tokens from the database. + * + * @since 4.0.0 + */ +function wp_destroy_current_session() { + $token = wp_get_session_token(); + if ( ! empty( $token ) ) { + $user_id = get_current_user_id(); + $verifier = hash( 'sha256', $token ); + $sessions = get_user_meta( $user_id, 'session_tokens', true ); + unset( $sessions[ $verifier ] ); + + // Expire old sessions + $time = time(); + foreach ( $sessions as $v => $e ) { + if ( $e < $time ) { + unset( $sessions[ $v ] ); + } + } + + if ( $sessions ) { + update_user_meta( $user_id, 'session_tokens', $sessions ); + } else { + delete_user_meta( $user_id, 'session_tokens' ); + } + } +} + +/** + * Retrieve the current session token from the logged_in cookie. + * + * @since 4.0.0 + * + * @return string + */ +function wp_get_session_token() { + $cookie = wp_parse_auth_cookie( '', 'logged_in' ); + return ! empty( $cookie['token'] ) ? $cookie['token'] : ''; +}