Update to phpass 0.5

[ayeshrajans]

WordPress currently uses PHPass library version 0.3.

This is over 10 years old now, and the latest version is 0.5. It doesn't dramatically improve the password hashing mechanism as it would have with a password_hash migration. However, I believe updating 0.5 still brings some strict comparison improvements made in the new version.

​https://www.openwall.com/phpass/

WordPress's copy of phpass ​was modified over time.

• ​Add a PHP 4-style constructor compat
• ​Ending PHP tag removal
• ​Limit password length to 4096 bytes

All changes need to be rebased to the version 0.5 as well.
(patch to follow)

[ayeshrajans]

Updated to phpass 0.5 from upstream, and applied ​wp-specific customizations

[ayeshrajans]

​tests passing

[Hareesh Pillai]

Requesting security feedback on this one so that we could move it forward.

[desrosj]

Related: #21022, #50027.

Thanks @ayeshrajans!

In the interest of keeping the library as consistent with the upstream library as possible, I think the first WP specific change could probably be omitted in the update. It looks like the PHP4 style constructor has been added to the official library and only the inline comment is different in WP now.

[desrosj]

I've discussed with some other members of the security team, and this one seems like a fine update.

51549.diff​ is the same as @ayeshrajans's patch with one exception. I removed the inline comments for the two constructor functions to bring the WordPress copy of the library more inline with the upstream version. When that adjustment was made to Core, the PHP 5 type constructor was not included in the upstream library. Now that it is, I think it makes more sense to remove it in favor of consistency.

Only the last two modifications in your list above should now be relevant.

[desrosj]

In 51008:

External Libraries: Update the phpass library to version 0.5.

This updates the phpass library from version 0.3 to the latest version of 0.5. This is a minor update that includes some adjustments to be more friendly with newer versions of PHP.

The changes made in [30466] have also been applied to the new version of the library. This should now be the only WordPress specific modification do this library.

Props ayeshrajans, dd32, otto42, desrosj.
Fixes #51549.