WordPress-C
/
WordPress
mirror of https://github.com/WordPress/WordPress.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

External Libraries: Update the phpass library to version `0.5`. 

This updates the phpass library from version `0.3` to the latest version of `0.5`. This is a minor update that includes some adjustments to be more friendly with newer versions of PHP.

The changes made in [30466] have also been applied to the new version of the library. This should now be the only WordPress specific modification do this library.

Props ayeshrajans, dd32, otto42, desrosj.
Fixes #51549.
Built from https://develop.svn.wordpress.org/trunk@51008


git-svn-id: http://core.svn.wordpress.org/trunk@50617 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
desrosj 2021-05-25 18:47:59 +00:00
parent 836b5ad7c7
commit e6ea717277
2 changed files with 40 additions and 66 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

102
wp-includes/class-phpass.php
View File

@ -3,16 +3,24 @@
* Portable PHP password hashing framework. * Portable PHP password hashing framework.
* @package phpass * @package phpass
* @since 2.5.0 * @since 2.5.0
* @version 0.3 / WordPress * @version 0.5 / WordPress
* @link https://www.openwall.com/phpass/ * @link https://www.openwall.com/phpass/
*/ */
#
# Portable PHP password hashing framework.
#
# Version 0.5 / WordPress.
# #
# Written by Solar Designer <solar at openwall.com> in 2004-2006 and placed in # Written by Solar Designer <solar at openwall.com> in 2004-2006 and placed in
# the public domain. Revised in subsequent years, still public domain. # the public domain. Revised in subsequent years, still public domain.
# #
# There's absolutely no warranty. # There's absolutely no warranty.
# #
# The homepage URL for this framework is:
#
# http://www.openwall.com/phpass/
#
# Please be sure to update the Version line if you edit this file in any way. # Please be sure to update the Version line if you edit this file in any way.
# It is suggested that you leave the main version number intact, but indicate # It is suggested that you leave the main version number intact, but indicate
# your project name (after the slash) and add your own revision information. # your project name (after the slash) and add your own revision information.
@ -29,7 +37,7 @@
* Portable PHP password hashing framework. * Portable PHP password hashing framework.
* *
* @package phpass * @package phpass
* @version 0.3 / WordPress * @version 0.5 / WordPress
* @link https://www.openwall.com/phpass/ * @link https://www.openwall.com/phpass/
* @since 2.5.0 * @since 2.5.0
*/ */
@ -39,10 +47,7 @@ class PasswordHash {
var $portable_hashes; var $portable_hashes;
var $random_state; var $random_state;
/** function __construct($iteration_count_log2, $portable_hashes)
* PHP5 constructor.
*/
function __construct( $iteration_count_log2, $portable_hashes )
{ {
$this->itoa64 = './0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz'; $this->itoa64 = './0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz';
@ -52,20 +57,20 @@ class PasswordHash {
$this->portable_hashes = $portable_hashes; $this->portable_hashes = $portable_hashes;
$this->random_state = microtime() . uniqid(rand(), TRUE); // removed getmypid() for compatibility reasons $this->random_state = microtime();
if (function_exists('getmypid'))
$this->random_state .= getmypid();
} }
/** function PasswordHash($iteration_count_log2, $portable_hashes)
* PHP4 constructor. {
*/ self::__construct($iteration_count_log2, $portable_hashes);
public function PasswordHash( $iteration_count_log2, $portable_hashes ) {
self::__construct( $iteration_count_log2, $portable_hashes );
} }
function get_random_bytes($count) function get_random_bytes($count)
{ {
$output = ''; $output = '';
if ( @is_readable('/dev/urandom') && if (@is_readable('/dev/urandom') &&
($fh = @fopen('/dev/urandom', 'rb'))) { ($fh = @fopen('/dev/urandom', 'rb'))) {
$output = fread($fh, $count); $output = fread($fh, $count);
fclose($fh); fclose($fh);
@ -76,8 +81,7 @@ class PasswordHash {
for ($i = 0; $i < $count; $i += 16) { for ($i = 0; $i < $count; $i += 16) {
$this->random_state = $this->random_state =
md5(microtime() . $this->random_state); md5(microtime() . $this->random_state);
$output .= $output .= md5($this->random_state, TRUE);
pack('H*', md5($this->random_state));
} }
$output = substr($output, 0, $count); $output = substr($output, 0, $count);
} }
@ -121,12 +125,12 @@ class PasswordHash {
function crypt_private($password, $setting) function crypt_private($password, $setting)
{ {
$output = '*0'; $output = '*0';
if (substr($setting, 0, 2) == $output) if (substr($setting, 0, 2) === $output)
$output = '*1'; $output = '*1';
$id = substr($setting, 0, 3); $id = substr($setting, 0, 3);
# We use "$P$", phpBB3 uses "$H$" for the same thing # We use "$P$", phpBB3 uses "$H$" for the same thing
if ($id != '$P$' && $id != '$H$') if ($id !== '$P$' && $id !== '$H$')
return $output; return $output;
$count_log2 = strpos($this->itoa64, $setting[3]); $count_log2 = strpos($this->itoa64, $setting[3]);
@ -136,26 +140,19 @@ class PasswordHash {
$count = 1 << $count_log2; $count = 1 << $count_log2;
$salt = substr($setting, 4, 8); $salt = substr($setting, 4, 8);
if (strlen($salt) != 8) if (strlen($salt) !== 8)
return $output; return $output;
# We're kind of forced to use MD5 here since it's the only # We were kind of forced to use MD5 here since it's the only
# cryptographic primitive available in all versions of PHP # cryptographic primitive that was available in all versions
# currently in use. To implement our own low-level crypto # of PHP in use. To implement our own low-level crypto in PHP
# in PHP would result in much worse performance and # would have resulted in much worse performance and
# consequently in lower iteration counts and hashes that are # consequently in lower iteration counts and hashes that are
# quicker to crack (by non-PHP code). # quicker to crack (by non-PHP code).
if (PHP_VERSION >= '5') { $hash = md5($salt . $password, TRUE);
$hash = md5($salt . $password, TRUE); do {
do { $hash = md5($hash . $password, TRUE);
$hash = md5($hash . $password, TRUE); } while (--$count);
} while (--$count);
} else {
$hash = pack('H*', md5($salt . $password));
do {
$hash = pack('H*', md5($hash . $password));
} while (--$count);
}
$output = substr($setting, 0, 12); $output = substr($setting, 0, 12);
$output .= $this->encode64($hash, 16); $output .= $this->encode64($hash, 16);
@ -163,24 +160,6 @@ class PasswordHash {
return $output; return $output;
} }
function gensalt_extended($input)
{
$count_log2 = min($this->iteration_count_log2 + 8, 24);
# This should be odd to not reveal weak DES keys, and the
# maximum valid value is (2**24 - 1) which is odd anyway.
$count = (1 << $count_log2) - 1;
$output = '_';
$output .= $this->itoa64[$count & 0x3f];
$output .= $this->itoa64[($count >> 6) & 0x3f];
$output .= $this->itoa64[($count >> 12) & 0x3f];
$output .= $this->itoa64[($count >> 18) & 0x3f];
$output .= $this->encode64($input, 3);
return $output;
}
function gensalt_blowfish($input) function gensalt_blowfish($input)
{ {
# This one needs to use a different order of characters and a # This one needs to use a different order of characters and a
@ -230,20 +209,11 @@ class PasswordHash {
$random = ''; $random = '';
if (CRYPT_BLOWFISH == 1 && !$this->portable_hashes) { if (CRYPT_BLOWFISH === 1 && !$this->portable_hashes) {
$random = $this->get_random_bytes(16); $random = $this->get_random_bytes(16);
$hash = $hash =
crypt($password, $this->gensalt_blowfish($random)); crypt($password, $this->gensalt_blowfish($random));
if (strlen($hash) == 60) if (strlen($hash) === 60)
return $hash;
}
if (CRYPT_EXT_DES == 1 && !$this->portable_hashes) {
if (strlen($random) < 3)
$random = $this->get_random_bytes(3);
$hash =
crypt($password, $this->gensalt_extended($random));
if (strlen($hash) == 20)
return $hash; return $hash;
} }
@ -252,7 +222,7 @@ class PasswordHash {
$hash = $hash =
$this->crypt_private($password, $this->crypt_private($password,
$this->gensalt_private($random)); $this->gensalt_private($random));
if (strlen($hash) == 34) if (strlen($hash) === 34)
return $hash; return $hash;
# Returning '*' on error is safe here, but would _not_ be safe # Returning '*' on error is safe here, but would _not_ be safe
@ -268,9 +238,13 @@ class PasswordHash {
} }
$hash = $this->crypt_private($password, $stored_hash); $hash = $this->crypt_private($password, $stored_hash);
if ($hash[0] == '*') if ($hash[0] === '*')
$hash = crypt($password, $stored_hash); $hash = crypt($password, $stored_hash);
# This is not constant-time. In order to keep the code simple,
# for timing safety we currently rely on the salts being
# unpredictable, which they are at least in the non-fallback
# cases (that is, when we use /dev/urandom and bcrypt).
return $hash === $stored_hash; return $hash === $stored_hash;
} }
} }

2
wp-includes/version.php
View File

@ -13,7 +13,7 @@
* *
* @global string $wp_version * @global string $wp_version
*/ */
$wp_version = '5.8-alpha-51007'; $wp_version = '5.8-alpha-51008';
/** /**
* Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema. * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.