mirror of
https://github.com/WordPress/WordPress.git
synced 2024-06-25 06:14:58 +02:00
Security: Harden the random aspect of the hash used for user profile and admin email address changes.
Props BjornW Fixes #43771 Merges [43367] to the 4.9 branch. Built from https://develop.svn.wordpress.org/branches/4.9@43368 git-svn-id: http://core.svn.wordpress.org/branches/4.9@43196 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
parent
15054d8a94
commit
1f5f8129de
|
@ -1158,7 +1158,7 @@ function update_option_new_admin_email( $old_value, $value ) {
|
|||
return;
|
||||
}
|
||||
|
||||
$hash = md5( $value . time() . mt_rand() );
|
||||
$hash = md5( $value . time() . wp_rand() );
|
||||
$new_admin_email = array(
|
||||
'hash' => $hash,
|
||||
'newemail' => $value,
|
||||
|
|
|
@ -2650,7 +2650,7 @@ function send_confirmation_on_profile_email() {
|
|||
return;
|
||||
}
|
||||
|
||||
$hash = md5( $_POST['email'] . time() . mt_rand() );
|
||||
$hash = md5( $_POST['email'] . time() . wp_rand() );
|
||||
$new_user_email = array(
|
||||
'hash' => $hash,
|
||||
'newemail' => $_POST['email'],
|
||||
|
|
|
@ -4,7 +4,7 @@
|
|||
*
|
||||
* @global string $wp_version
|
||||
*/
|
||||
$wp_version = '4.9.7-alpha-43366';
|
||||
$wp_version = '4.9.7-alpha-43368';
|
||||
|
||||
/**
|
||||
* Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
|
||||
|
|
Loading…
Reference in New Issue
Block a user