Ticket #528: WPMU_1.3_Tag_Patch.diff

wp-login.php

@@ -185 +185 @@
-
-        // Generate something random for a password... md5'ing current time with a rand salt
-        $new_pass = substr( md5( uniqid( microtime() ) ), 0, 7);
-
+
+
-        wp_cache_delete($user->ID, 'users');
-        wp_cache_delete($user->user_login, 'userlogins');
-        $message  = sprintf(__('Username: %s'), $user->user_login) . "\r\n";
-        $message .= sprintf(__('Password: %s'), $new_pass) . "\r\n";
-        $message .= get_option('siteurl') . "/wp-login.php\r\n";
@@ -207 +207 @@
-default:
-        $user_login = '';
-        $user_pass = '';
-        $using_cookie = FALSE;
-
-        if ( !isset( $_REQUEST['redirect_to'] ) || is_user_logged_in() )
-                $redirect_to = 'wp-admin/';
@@ -215 +214 @@
-                $redirect_to = $_REQUEST['redirect_to'];
-
-        if ( $_POST ) {
+                // If cookies are disabled we can't log in even with a valid user+pass
+                if ( empty($_COOKIE[TEST_COOKIE]) )
+                        $errors['test_cookie'] = __('<strong>ERROR</strong>: WordPress requires Cookies but your browser does not support them or they are blocked.');
+                
-                $user_login = $_POST['log'];
-                $user_login = sanitize_user( $user_login );
-                $user_pass  = $_POST['pwd'];
-                $rememberme = $_POST['rememberme'];
+                
+                do_action_ref_array('wp_authenticate', array(&$user_login, &$user_pass));
-        } else {
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
-                }
-        }
-
-
-
-
-
-
-
+
-        if ( $user_login && $user_pass && empty( $errors ) ) {
-                $user = new WP_User(0, $user_login);
-
@@ -241 +247 @@
-                if ( !$user->has_cap('edit_posts') && ( empty( $redirect_to ) || $redirect_to == 'wp-admin/' ) )
-                        $redirect_to = get_option('siteurl') . '/wp-admin/profile.php';
-
-
-
-
+
+
-                        do_action('wp_login', $user_login);
-                        wp_safe_redirect($redirect_to);
-                        exit();
-                } else {
-                        if ( $using_cookie )
-                                $errors['expiredsession'] = __('Your session has expired.');
-                }
-        }
-

wp-includes/class-phpass.php

@@ +1 @@
+<?php
+/**
+ * Portable PHP password hashing framework.
+ * @package phpass
+ * @since 2.4
+ * @version 0.1
+ * @link http://www.openwall.com/phpass/
+ */
+
+#
+# Portable PHP password hashing framework.
+#
+# Version 0.1 / genuine.
+#
+# Written by Solar Designer <solar at openwall.com> in 2004-2006 and placed in
+# the public domain.
+#
+# There's absolutely no warranty.
+#
+# The homepage URL for this framework is:
+#
+#       http://www.openwall.com/phpass/
+#
+# Please be sure to update the Version line if you edit this file in any way.
+# It is suggested that you leave the main version number intact, but indicate
+# your project name (after the slash) and add your own revision information.
+#
+# Please do not change the "private" password hashing method implemented in
+# here, thereby making your hashes incompatible.  However, if you must, please
+# change the hash type identifier (the "$P$") to something different.
+#
+# Obviously, since this code is in the public domain, the above are not
+# requirements (there can be none), but merely suggestions.
+#
+class PasswordHash {
+        var $itoa64;
+        var $iteration_count_log2;
+        var $portable_hashes;
+        var $random_state;
+
+        function PasswordHash($iteration_count_log2, $portable_hashes)
+        {
+                $this->itoa64 = './0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz';
+
+                if ($iteration_count_log2 < 4 || $iteration_count_log2 > 31)
+                        $iteration_count_log2 = 8;
+                $this->iteration_count_log2 = $iteration_count_log2;
+
+                $this->portable_hashes = $portable_hashes;
+
+                $this->random_state = microtime() . getmypid();
+        }
+
+        function get_random_bytes($count)
+        {
+                $output = '';
+                if (($fh = @fopen('/dev/urandom', 'rb'))) {
+                        $output = fread($fh, $count);
+                        fclose($fh);
+                }
+
+                if (strlen($output) < $count) {
+                        $output = '';
+                        for ($i = 0; $i < $count; $i += 16) {
+                                $this->random_state =
+                                    md5(microtime() . $this->random_state);
+                                $output .=
+                                    pack('H*', md5($this->random_state));
+                        }
+                        $output = substr($output, 0, $count);
+                }
+
+                return $output;
+        }
+
+        function encode64($input, $count)
+        {
+                $output = '';
+                $i = 0;
+                do {
+                        $value = ord($input[$i++]);
+                        $output .= $this->itoa64[$value & 0x3f];
+                        if ($i < $count)
+                                $value |= ord($input[$i]) << 8;
+                        $output .= $this->itoa64[($value >> 6) & 0x3f];
+                        if ($i++ >= $count)
+                                break;
+                        if ($i < $count)
+                                $value |= ord($input[$i]) << 16;
+                        $output .= $this->itoa64[($value >> 12) & 0x3f];
+                        if ($i++ >= $count)
+                                break;
+                        $output .= $this->itoa64[($value >> 18) & 0x3f];
+                } while ($i < $count);
+
+                return $output;
+        }
+
+        function gensalt_private($input)
+        {
+                $output = '$P$';
+                $output .= $this->itoa64[min($this->iteration_count_log2 +
+                        ((PHP_VERSION >= '5') ? 5 : 3), 30)];
+                $output .= $this->encode64($input, 6);
+
+                return $output;
+        }
+
+        function crypt_private($password, $setting)
+        {
+                $output = '*0';
+                if (substr($setting, 0, 2) == $output)
+                        $output = '*1';
+
+                if (substr($setting, 0, 3) != '$P$')
+                        return $output;
+
+                $count_log2 = strpos($this->itoa64, $setting[3]);
+                if ($count_log2 < 7 || $count_log2 > 30)
+                        return $output;
+
+                $count = 1 << $count_log2;
+
+                $salt = substr($setting, 4, 8);
+                if (strlen($salt) != 8)
+                        return $output;
+
+                # We're kind of forced to use MD5 here since it's the only
+                # cryptographic primitive available in all versions of PHP
+                # currently in use.  To implement our own low-level crypto
+                # in PHP would result in much worse performance and
+                # consequently in lower iteration counts and hashes that are
+                # quicker to crack (by non-PHP code).
+                if (PHP_VERSION >= '5') {
+                        $hash = md5($salt . $password, TRUE);
+                        do {
+                                $hash = md5($hash . $password, TRUE);
+                        } while (--$count);
+                } else {
+                        $hash = pack('H*', md5($salt . $password));
+                        do {
+                                $hash = pack('H*', md5($hash . $password));
+                        } while (--$count);
+                }
+
+                $output = substr($setting, 0, 12);
+                $output .= $this->encode64($hash, 16);
+
+                return $output;
+        }
+
+        function gensalt_extended($input)
+        {
+                $count_log2 = min($this->iteration_count_log2 + 8, 24);
+                # This should be odd to not reveal weak DES keys, and the
+                # maximum valid value is (2**24 - 1) which is odd anyway.
+                $count = (1 << $count_log2) - 1;
+
+                $output = '_';
+                $output .= $this->itoa64[$count & 0x3f];
+                $output .= $this->itoa64[($count >> 6) & 0x3f];
+                $output .= $this->itoa64[($count >> 12) & 0x3f];
+                $output .= $this->itoa64[($count >> 18) & 0x3f];
+
+                $output .= $this->encode64($input, 3);
+
+                return $output;
+        }
+
+        function gensalt_blowfish($input)
+        {
+                # This one needs to use a different order of characters and a
+                # different encoding scheme from the one in encode64() above.
+                # We care because the last character in our encoded string will
+                # only represent 2 bits.  While two known implementations of
+                # bcrypt will happily accept and correct a salt string which
+                # has the 4 unused bits set to non-zero, we do not want to take
+                # chances and we also do not want to waste an additional byte
+                # of entropy.
+                $itoa64 = './ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
+
+                $output = '$2a$';
+                $output .= chr(ord('0') + $this->iteration_count_log2 / 10);
+                $output .= chr(ord('0') + $this->iteration_count_log2 % 10);
+                $output .= '$';
+
+                $i = 0;
+                do {
+                        $c1 = ord($input[$i++]);
+                        $output .= $itoa64[$c1 >> 2];
+                        $c1 = ($c1 & 0x03) << 4;
+                        if ($i >= 16) {
+                                $output .= $itoa64[$c1];
+                                break;
+                        }
+
+                        $c2 = ord($input[$i++]);
+                        $c1 |= $c2 >> 4;
+                        $output .= $itoa64[$c1];
+                        $c1 = ($c2 & 0x0f) << 2;
+
+                        $c2 = ord($input[$i++]);
+                        $c1 |= $c2 >> 6;
+                        $output .= $itoa64[$c1];
+                        $output .= $itoa64[$c2 & 0x3f];
+                } while (1);
+
+                return $output;
+        }
+
+        function HashPassword($password)
+        {
+                $random = '';
+
+                if (CRYPT_BLOWFISH == 1 && !$this->portable_hashes) {
+                        $random = $this->get_random_bytes(16);
+                        $hash =
+                            crypt($password, $this->gensalt_blowfish($random));
+                        if (strlen($hash) == 60)
+                                return $hash;
+                }
+
+                if (CRYPT_EXT_DES == 1 && !$this->portable_hashes) {
+                        if (strlen($random) < 3)
+                                $random = $this->get_random_bytes(3);
+                        $hash =
+                            crypt($password, $this->gensalt_extended($random));
+                        if (strlen($hash) == 20)
+                                return $hash;
+                }
+
+                if (strlen($random) < 6)
+                        $random = $this->get_random_bytes(6);
+                $hash =
+                    $this->crypt_private($password,
+                    $this->gensalt_private($random));
+                if (strlen($hash) == 34)
+                        return $hash;
+
+                # Returning '*' on error is safe here, but would _not_ be safe
+                # in a crypt(3)-like function used _both_ for generating new
+                # hashes and for validating passwords against existing hashes.
+                return '*';
+        }
+
+        function CheckPassword($password, $stored_hash)
+        {
+                $hash = $this->crypt_private($password, $stored_hash);
+                if ($hash[0] == '*')
+                        $hash = crypt($password, $stored_hash);
+
+                return $hash == $stored_hash;
+        }
+}
+
+?>

wp-includes/compat.php

@@ -147 +147 @@
-        }
-}
-
+if ( ! function_exists('hash_hmac') ):
+function hash_hmac($algo, $data, $key, $raw_output = false) {
+        $packs = array('md5' => 'H32', 'sha1' => 'H40');
+
+        if ( !isset($packs[$algo]) )
+                return false;
+
+        $pack = $packs[$algo];
+
+        if (strlen($key) > 64)
+                $key = pack($pack, $algo($key));
+        else if (strlen($key) < 64)
+                $key = str_pad($key, 64, chr(0));
+        
+        $ipad = (substr($key, 0, 64) ^ str_repeat(chr(0x36), 64));
+        $opad = (substr($key, 0, 64) ^ str_repeat(chr(0x5C), 64));
+
+        return $algo($opad . pack($pack, $algo($ipad . $data)));
+}
+endif;
+
-?>

wp-includes/pluggable.php

@@ -46 +46 @@
-        if ( ! empty($current_user) )
-                return;
-
-
-
+
-                wp_set_current_user(0);
-                return false;
-        }
-
-
-
+
-}
-endif;
-
@@ -301 +299 @@
-endif;
-
-if ( !function_exists('wp_login') ) :
-already_md5
+deprecated
-        global $wpdb, $error, $current_user;
-
-        $username = sanitize_user($username);
@@ -346 +344 @@
-                                return false;
-                        }
-                }
+
+                /*
-                // If the password is already_md5, it has been double hashed.
-                // Otherwise, it is plain text.
-                if ( ($already_md5 && $login->user_login == $username && md5($login->user_pass) == $password) || ($login->user_login == $username && $login->user_pass == md5($password)) ) {
@@ -355 +355 @@
-                        $pwd = '';
-                        return false;
-                }
+                */
+                
+                if ( !wp_check_password($password, $login->user_pass) ) {
+                        $error = __('<strong>ERROR</strong>: Incorrect password.');
+                        return false;
+                }
+        
+                // If using old md5 password, rehash.
+                if ( strlen($login->user_pass) <= 32 ) {
+                        $hash = wp_hash_password($password);
+                        $wpdb->query("UPDATE $wpdb->users SET user_pass = '$hash', user_activation_key = '' WHERE ID = '$login->ID'");
+                        wp_cache_delete($login->ID, 'users');
+                }
+        
+                return true;
+                
-        }
-}
-endif;
-
+if ( !function_exists('wp_validate_auth_cookie') ) :
+function wp_validate_auth_cookie($cookie = '') {
+        if ( empty($cookie) ) {
+                if ( empty($_COOKIE[AUTH_COOKIE]) )
+                        return false;
+                $cookie = $_COOKIE[AUTH_COOKIE];
+        }
+
+        list($username, $expiration, $hmac) = explode('|', $cookie);
+
+        $expired = $expiration;
+
+        // Allow a grace period for POST and AJAX requests
+        if ( defined('DOING_AJAX') || 'POST' == $_SERVER['REQUEST_METHOD'] )
+                $expired += 3600;
+
+        if ( $expired < time() )
+                return false;
+
+        $key = wp_hash($username . $expiration);
+        $hash = hash_hmac('md5', $username . $expiration, $key);
+        
+        if ( $hmac != $hash )
+                return false;
+
+        $user = get_userdatabylogin($username);
+        if ( ! $user )
+                return false;
+
+        return $user->ID;
+}
+endif;
+
+if ( !function_exists('wp_set_auth_cookie') ) :
+function wp_set_auth_cookie($user_id, $remember = false) {
+        $user = get_userdata($user_id);
+
+        if ( $remember ) {
+                $expiration = $expire = time() + 1209600;
+        } else {
+                $expiration = time() + 172800;
+                $expire = 0;
+        }
+
+        $key = wp_hash($user->user_login . $expiration);
+        $hash = hash_hmac('md5', $user->user_login . $expiration, $key);
+
+        $cookie = $user->user_login . '|' . $expiration . '|' . $hash;
+
+        setcookie(AUTH_COOKIE, $cookie, $expire, COOKIEPATH, COOKIE_DOMAIN);
+        if ( COOKIEPATH != SITECOOKIEPATH )
+                setcookie(AUTH_COOKIE, $cookie, $expire, SITECOOKIEPATH, COOKIE_DOMAIN);
+}
+endif;
+
+if ( !function_exists('wp_clear_auth_cookie') ) :
+function wp_clear_auth_cookie() {
+        setcookie(AUTH_COOKIE, ' ', time() - 31536000, COOKIEPATH, COOKIE_DOMAIN);
+        setcookie(AUTH_COOKIE, ' ', time() - 31536000, SITECOOKIEPATH, COOKIE_DOMAIN);
+
+        // Old cookies
+        setcookie(USER_COOKIE, ' ', time() - 31536000, COOKIEPATH, COOKIE_DOMAIN);
+        setcookie(PASS_COOKIE, ' ', time() - 31536000, COOKIEPATH, COOKIE_DOMAIN);
+        setcookie(USER_COOKIE, ' ', time() - 31536000, SITECOOKIEPATH, COOKIE_DOMAIN);
+        setcookie(PASS_COOKIE, ' ', time() - 31536000, SITECOOKIEPATH, COOKIE_DOMAIN);  
+}
+endif;
+
+
-if ( !function_exists('is_user_logged_in') ) :
-function is_user_logged_in() {
-        $user = wp_get_current_user();
@@ -373 +458 @@
-if ( !function_exists('auth_redirect') ) :
-function auth_redirect() {
-        // Checks if a user is logged in, if not redirects them to the login page
-USER
-login($_COOKIE[USER_COOKIE], $_COOKIE[PASS_COOKIE], true
-USER
+AUTH
+validate_auth_cookie($_COOKIE[AUTH_COOKIE]
+AUTH
-                nocache_headers();
-                wp_clearcookie();
-
@@ -399 +484 @@
-
-if ( !function_exists('check_ajax_referer') ) :
-function check_ajax_referer() {
-name
+id
-        if ( ( $current = wp_get_current_user() ) && $current->ID )
-name = $current->data->user_login
-name
+id = $current->ID
+id
-                die('-1');
-
+        $auth_cookie = '';
-        $cookie = explode('; ', urldecode(empty($_POST['cookie']) ? $_GET['cookie'] : $_POST['cookie'])); // AJAX scripts must pass cookie=document.cookie
-        foreach ( $cookie as $tasty ) {
-
-
-
-
+
+
-        }
-
-$current_name != $user || !wp_login( $user, $pass, true 
+empty($auth_cookie
-                die('-1');
+
+        if ( ! $user_id = wp_validate_auth_cookie( $auth_cookie ) )
+                die('-1');
+
+        if ( $current_id != $user_id )
+                die('-1');
+                        
-        do_action('check_ajax_referer');
-}
-endif;
@@ -493 +584 @@
-}
-endif;
-
-if ( !function_exists('wp_get_cookie_login') ):
-function wp_get_cookie_login() {
-        if ( empty($_COOKIE[USER_COOKIE]) || empty($_COOKIE[PASS_COOKIE]) )
-                return false;
-
-        return array('login' => $_COOKIE[USER_COOKIE],  'password' => $_COOKIE[PASS_COOKIE]);
-}
-
-endif;
-
-if ( !function_exists('wp_setcookie') ) :
-function wp_setcookie($username, $password, $already_md5 = false, $home = '', $siteurl = '', $remember = false) {
-        if ( !$already_md5 )
-                $password = md5( md5($password) ); // Double hash the password in the cookie.
-
-        if ( empty($home) )
-                $cookiepath = COOKIEPATH;
-        else
-                $cookiepath = preg_replace('|https?://[^/]+|i', '', $home . '/' );
-
-        if ( empty($siteurl) ) {
-                $sitecookiepath = SITECOOKIEPATH;
-                $cookiehash = COOKIEHASH;
-        } else {
-                $sitecookiepath = preg_replace('|https?://[^/]+|i', '', $siteurl . '/' );
-                $cookiehash = md5($siteurl);
-        }
-
-        if ( $remember )
-                $expire = time() + 31536000;
-        else
-                $expire = 0;
-
-        setcookie(USER_COOKIE, $username, $expire, $cookiepath, COOKIE_DOMAIN);
-        setcookie(PASS_COOKIE, $password, $expire, $cookiepath, COOKIE_DOMAIN);
-
-        if ( $cookiepath != $sitecookiepath ) {
-                setcookie(USER_COOKIE, $username, $expire, $sitecookiepath, COOKIE_DOMAIN);
-                setcookie(PASS_COOKIE, $password, $expire, $sitecookiepath, COOKIE_DOMAIN);
-        }
-}
-endif;
-
-if ( !function_exists('wp_clearcookie') ) :
-function wp_clearcookie() {
-        setcookie(USER_COOKIE, ' ', time() - 31536000, COOKIEPATH, COOKIE_DOMAIN);
-        setcookie(PASS_COOKIE, ' ', time() - 31536000, COOKIEPATH, COOKIE_DOMAIN);
-        setcookie(USER_COOKIE, ' ', time() - 31536000, SITECOOKIEPATH, COOKIE_DOMAIN);
-        setcookie(PASS_COOKIE, ' ', time() - 31536000, SITECOOKIEPATH, COOKIE_DOMAIN);
-}
-endif;
-
-if ( ! function_exists('wp_notify_postauthor') ) :
-function wp_notify_postauthor($comment_id, $comment_type='') {
-        global $wpdb;
@@ -712 +752 @@
-
-if ( !function_exists('wp_salt') ) :
-function wp_salt() {
+        if ( defined('SECRET_KEY') && '' != SECRET_KEY )
+                return SECRET_KEY;
+
-        $salt = get_option('secret');
-
-
+
+
+
+
-
-        return $salt;
-}
@@ -732 +777 @@
-}
-endif;
-
+if ( !function_exists('wp_hash_password') ) :
+function wp_hash_password($password) {
+        global $wp_hasher;
+
+        if ( empty($wp_hasher) ) {
+                require_once( ABSPATH . 'wp-includes/class-phpass.php');
+                // By default, use the portable hash from phpass
+                $wp_hasher = new PasswordHash(8, TRUE);
+        }
+        
+        return $wp_hasher->HashPassword($password); 
+}
+endif;
+
+
+if ( !function_exists('wp_check_password') ) :
+function wp_check_password($password, $hash) {
+        global $wp_hasher;
+
+        if ( strlen($hash) <= 32 )
+                return ( $hash == md5($password) );
+
+        // If the stored hash is longer than an MD5, presume the
+        // new style phpass portable hash.
+        if ( empty($wp_hasher) ) {
+                require_once( ABSPATH . 'wp-includes/class-phpass.php');
+                // By default, use the portable hash from phpass
+                $wp_hasher = new PasswordHash(8, TRUE);
+        }
+
+        return $wp_hasher->CheckPassword($password, $hash);
+}
+endif;
+
+
+// Deprecated. Use wp_set_auth_cookie()
+if ( !function_exists('wp_setcookie') ) :
+function wp_setcookie($username, $password = '', $already_md5 = false, $home = '', $siteurl = '', $remember = false) {
+        $user = get_userdatabylogin($username);
+        wp_set_auth_cookie($user->ID, $remember);
+}
+endif;
+
+// Deprecated. Use wp_clear_auth_cookie()
+if ( !function_exists('wp_clearcookie') ) :
+function wp_clearcookie() {
+        wp_clear_auth_cookie();
+}
+endif;
+
+// Deprecated.  No alternative.
+if ( !function_exists('wp_get_cookie_login') ):
+function wp_get_cookie_login() {
+        return false;
+}
+endif;
+
+
-?>

wp-includes/registration.php

@@ -54 +54 @@
-        } else {
-                $update = false;
-                // Password is not hashed when creating new user.
-md5
+wp_hash_password
-        }
-
-        $user_login = sanitize_user($user_login, true);
@@ -163 +163 @@
-        // If password is changing, hash it now.
-        if ( ! empty($userdata['user_pass']) ) {
-                $plaintext_pass = $userdata['user_pass'];
-md5
+wp_hash_password
-        }
-
-        // Merge old and new fields with new fields overwriting old ones.
@@ -174 +174 @@
-        $current_user = wp_get_current_user();
-        if ( $current_user->id == $ID ) {
-                if ( isset($plaintext_pass) ) {
-
-cookie($userdata['user_login'], $plaintext_pass
+_auth_
+_auth_cookie($ID
-                }
-        }
-

wp-includes/user.php

@@ -21 +21 @@
-        } else {
-                $userdata = $cache_userdata[$user_login];
-        }
-md5
+wp_hash_password
-}
-
-//

wp-config-sample.php

@@ -7 +7 @@
-define('DB_HOST', 'localhost');    // 99% chance you won't need to change this value
-define('DB_CHARSET', 'utf8');
-define('DB_COLLATE', '');
+define('SECRET_KEY', ''); // Change this to a unique phrase.
-define('VHOST', 'VHOSTSETTING'); 
-$base = 'BASE';
-

wp-settings.php

@@ -284 +284 @@
-endif;
-
-if ( !defined('USER_COOKIE') )
-'
+_' . COOKIEHASH
-if ( !defined('PASS_COOKIE') )
-
+
+
+
-if ( !defined('COOKIEPATH') )
-        define('COOKIEPATH', $current_site->path );
-if ( !defined('SITECOOKIEPATH') )

wp-admin/includes/misc.php

@@ -129 +129 @@
-        update_option( 'recently_edited', $oldfiles );
-}
-
-reset cookies and 
+
-function update_home_siteurl( $old_value, $value ) {
-        global $wp_rewrite, $user_login, $user_pass_md5;
-
@@ -138 +138 @@
-
-        // If home changed, write rewrite rules to new location.
-        $wp_rewrite->flush_rules();
-        // Clear cookies for old paths.
-        wp_clearcookie();
-        // Set cookies for new paths.
-        wp_setcookie( $user_login, $user_pass_md5, true, get_option( 'home' ), get_option( 'siteurl' ));
-}
-
-add_action( 'update_option_home', 'update_home_siteurl', 10, 2 );