Passwords containing ' or " via wp_set_password() break login via wp-login.php

[manuakasam]

We are using custom plugins to have the user reset their passwords. Internally all that is done boils down to the following code:

wp_set_password('Test"123', 1);
// alternative test
wp_update_user([
    'ID' => 1,
    'user_password' => 'Test"123'
]);

Doing this the password gets successfully changed inside the database.

Trying to login on wp-login.php now with the new password results in: "ERROR: The password you entered for the username admin is incorrect"

Login however still works using wp_signon().

I don't know what's going on there or where the differences are but surely this can't be intended behavior that we're not supposed to set passwords using ' or " via wp_set_passworod(), can it?

[ocean90]

Hello @manuakasam, welcome to Trac!

Previously: #26573, #24367

It looks like you have to slash the passwords via wp_slash() first. I think we should add a note for this to all the password functions.

[manuakasam]

I wonder what I did wrong then when I manually escaped it myself :S

I can confirm that this solves the issue, so as you mentioned this is simply a documentation issue and not a bug itself.

wp_signon() and wp_set_password() and wp_update_user() would require this information. Potentionally more but those are the ones that I came into contact with now.

Thank you for the super quick response!

[wonderboymusic]

Your only other choice is:

/**
 * Strip the slashes from Cookies
 */
function _fix_cookies() {
    $_COOKIE = stripslashes_deep( $_COOKIE );
}
add_action( 'sanitize_comment_cookies', '_fix_cookies' );

I almost threw my computer out the window 4 years ago when I found this awful mess.

[DrewAPicture]

docs focus is enough ;)

[boonebgorges]

Two steps to write the patch:

1. Look through the functions that expect a password, and determine (maybe through trial and error) which of them expect passwords to be slashed.
2. Modify the docs accordingly.

[devplus_timo]

Hello @manuakasam and @ocean90, wouldn't it be a nice idea to, instead of mentioning the wp_slash() in the docs for wp_signon(), wp_set_password() and wp_update_user(), write a check for these quotes in the plain text password and if so, wrap the wp_slash() function around the plain text password in core ourselves so that we can take away the need for developers to really needing to read that part of the documentation?

[stevenlinx]

Apologies, the red and green colored code block in the previous patch should be reversed.

A revised version was uploaded.

[johnbillion]

Punting this because, incredibly, it's actually difficult to tell which fields in these functions need slashing and which don't. Needs someone to spend some time going through the call stack.