Cache exposes some user data

[ringmaster]

Using the new cache system, some sensitive user data is easier to obtain than before.

Steps:

1. Guess a WordPress username (like "admin").
2. Obtain an MD5 hash of that username, call it XX.
3. Access a file named ​http://example.com/wp-content/cache/users/{XX}

The data exposed contains the database record for that user. At least, it exposes the user's email address. At worst, this could be used to reverse-engineer cookies that would allow enough access to change the password of that user.

Attached patch uses the database password to seed the hashes, making the filenames that contain this data more difficult to guess.

Consider adding .htaccess to the cache directory to prevent direct access/prevent directory browsing? Consider hashing the cache directory names to prevent directory guessing? Consider not caching user data?

[ringmaster]

Add a little salt.

[ryan]

Also maybe put an index.php in the cache dirs.

[ryan]

(In [3017]) Obfuscate keys with some salt. Add empty index.php files to the cache dirs to prevent directory listings. Props to ringmaster. fixes #1851