wp_check_password() and issue with trailing space

[jperlman]

I have users logging in via wp-login.php and then filling out a custom form with the last field entered being their WordPress password.

One specific user can login fine to wp-login.php but when she enters information on the form and her WordPress password, validation fails on wp_check_password().

I realized that her password contains a space at the end.

By creating a brand new user and ensuring it contains a space the bug is evident with the test script I've uploaded.

The version of the production site at the moment is 4.1.1 of where I first saw the bug, but I can reproduce this issue on a brand new WordPress install of 4.3.1 and from the github version currently at 4.5-alpha-35794.

Looks like it's related to but different than ticket

https://core.trac.wordpress.org/ticket/23494

[adrianosilvaferreira]

I've added trim for $password in wp_check_password.

[adrianosilvaferreira]

Sorry for the typo plugable.

[tyxla]

This was implemented on purpose in #24973. It's arguable whether trailing spaces should be allowed in a password.