mirror_php/wordpress
1
0
Fork 0
mirror of git://develop.git.wordpress.org/ synced 2025-02-25 17:13:30 +01:00
Code Issues Actions 10 Packages Projects Releases Wiki Activity

Add safeguards for when ext/hash is not compiled with PHP.

Browse Source 
see #29518, for trunk.


git-svn-id: https://develop.svn.wordpress.org/trunk@29751 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Andrew Nacin 2014-09-20 17:27:46 +00:00
parent 5b2c58d5b3
commit 4c1462f2ff
2 changed files with 14 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/wp-includes/pluggable.php
View File

@ -669,7 +669,10 @@ function wp_validate_auth_cookie($cookie = '', $scheme = '') {
$pass_frag = substr($user->user_pass, 8, 4);
$key = wp_hash( $username . '|' . $pass_frag . '|' . $expiration . '|' . $token, $scheme );
$hash = hash_hmac( 'sha256', $username . '|' . $expiration . '|' . $token, $key );
// If ext/hash is not present, compat.php's hash_hmac() does not support sha256.
$algo = function_exists( 'hash' ) ? 'sha256' : 'sha1';
$hash = hash_hmac( $algo, $username . '|' . $expiration . '|' . $token, $key );
if ( ! hash_equals( $hash, $hmac ) ) {
/**
@ -734,7 +737,10 @@ function wp_generate_auth_cookie( $user_id, $expiration, $scheme = 'auth', $toke
$pass_frag = substr($user->user_pass, 8, 4);
$key = wp_hash( $user->user_login . '|' . $pass_frag . '|' . $expiration . '|' . $token, $scheme );
$hash = hash_hmac( 'sha256', $user->user_login . '|' . $expiration . '|' . $token, $key );
// If ext/hash is not present, compat.php's hash_hmac() does not support sha256.
$algo = function_exists( 'hash' ) ? 'sha256' : 'sha1';
$hash = hash_hmac( $algo, $user->user_login . '|' . $expiration . '|' . $token, $key );
$cookie = $user->user_login . '|' . $expiration . '|' . $token . '|' . $hash;

7
src/wp-includes/session.php
View File

@ -61,7 +61,12 @@ abstract class WP_Session_Tokens {
* @return string A hash of the session token (a verifier).
*/
final private function hash_token( $token ) {
return hash( 'sha256', $token );
// If ext/hash is not present, use sha1() instead.
if ( function_exists( 'hash' ) ) {
return hash( 'sha256', $token );
} else {
return sha1( $token );
}
}
/**