Notice on "get_instance_hash_key()"

[juliobox]

Hello

In get_instance_hash_key() in https://core.trac.wordpress.org/browser/tags/3.9/src/wp-includes/class-wp-customize-widgets.php#L1140 tries to read a constant, hardcoded.

$hash = md5( AUTH_KEY . serialize( $instance ) );

I propose to do it in a good way, as usual in fact:

$hash = md5( wp_salt( 'auth' ) . serialize( $instance ) );

Thank you

[juliobox]

Modified get_instance_hash_key()

[westonruter]

Good catch. For that matter, should we not just go ahead and use wp_hash as well?

- $hash = md5( AUTH_KEY . serialize( $instance ) ); 
+ $hash = wp_hash( serialize( $instance ) );

[juliobox]

@westonruter you're right this is better, new patch added.

[SergeyBiryukov]

In 29028:

Use wp_hash() instead of AUTH_KEY in WP_Customize_Widgets::get_instance_hash_key().

props juliobox.
fixes #28783.