mirror_php/wordpress
1
0
Fork 0
mirror of git://develop.git.wordpress.org/ synced 2025-01-18 05:18:42 +01:00
Code Issues Actions 10 Packages Projects Releases Wiki Activity

Double hash password in cookies.

Browse Source 
git-svn-id: https://develop.svn.wordpress.org/trunk@1788 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Ryan Boren 2004-10-13 02:21:37 +00:00
parent afe389d930
commit 0bee08aace
2 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
wp-includes/functions.php
View File

@ -1900,7 +1900,9 @@ function wp_login($username, $password, $already_md5 = false) {
$error = __('<strong>Error</strong>: Wrong login.');
return false;
} else {
if ( ($already_md5 && $login->user_login == $username && $login->user_pass == $password) || ($login->user_login == $username && $login->user_pass == md5($password)) ) {
// If the password is already_md5, it has been double hashed.
// Otherwise, it is plain text.
if ( ($already_md5 && $login->user_login == $username && md5($login->user_pass) == $password) || ($login->user_login == $username && $login->user_pass == md5($password)) ) {
return true;
} else {
$error = __('<strong>Error</strong>: Incorrect password.');

2
wp-login.php
View File

@ -159,7 +159,7 @@ default:
if ($log && $pwd) {
if ( wp_login($log, $pwd) ) {
$user_login = $log;
$user_pass = md5($pwd);
$user_pass = md5(md5($pwd)); // Double hash the password in the cookie.
setcookie('wordpressuser_'. COOKIEHASH, $user_login, time() + 31536000, COOKIEPATH);
setcookie('wordpresspass_'. COOKIEHASH, $user_pass, time() + 31536000, COOKIEPATH);