From 75ff6ae3023ffa4a96015f7ed6fe64958f64c2bf Mon Sep 17 00:00:00 2001 From: Andrew Nacin Date: Sat, 20 Sep 2014 17:28:18 +0000 Subject: [PATCH] Add safeguards for when ext/hash is not compiled with PHP. see #29518, for trunk. Built from https://develop.svn.wordpress.org/trunk@29751 git-svn-id: http://core.svn.wordpress.org/trunk@29523 1a063a9b-81f0-0310-95a4-ce76da25c4cd --- wp-includes/pluggable.php | 10 ++++++++-- wp-includes/session.php | 7 ++++++- 2 files changed, 14 insertions(+), 3 deletions(-) diff --git a/wp-includes/pluggable.php b/wp-includes/pluggable.php index 872da82ad0..d7c609c52f 100644 --- a/wp-includes/pluggable.php +++ b/wp-includes/pluggable.php @@ -669,7 +669,10 @@ function wp_validate_auth_cookie($cookie = '', $scheme = '') { $pass_frag = substr($user->user_pass, 8, 4); $key = wp_hash( $username . '|' . $pass_frag . '|' . $expiration . '|' . $token, $scheme ); - $hash = hash_hmac( 'sha256', $username . '|' . $expiration . '|' . $token, $key ); + + // If ext/hash is not present, compat.php's hash_hmac() does not support sha256. + $algo = function_exists( 'hash' ) ? 'sha256' : 'sha1'; + $hash = hash_hmac( $algo, $username . '|' . $expiration . '|' . $token, $key ); if ( ! hash_equals( $hash, $hmac ) ) { /** @@ -734,7 +737,10 @@ function wp_generate_auth_cookie( $user_id, $expiration, $scheme = 'auth', $toke $pass_frag = substr($user->user_pass, 8, 4); $key = wp_hash( $user->user_login . '|' . $pass_frag . '|' . $expiration . '|' . $token, $scheme ); - $hash = hash_hmac( 'sha256', $user->user_login . '|' . $expiration . '|' . $token, $key ); + + // If ext/hash is not present, compat.php's hash_hmac() does not support sha256. + $algo = function_exists( 'hash' ) ? 'sha256' : 'sha1'; + $hash = hash_hmac( $algo, $user->user_login . '|' . $expiration . '|' . $token, $key ); $cookie = $user->user_login . '|' . $expiration . '|' . $token . '|' . $hash; diff --git a/wp-includes/session.php b/wp-includes/session.php index dca4d94e9a..2acaad31d5 100644 --- a/wp-includes/session.php +++ b/wp-includes/session.php @@ -61,7 +61,12 @@ abstract class WP_Session_Tokens { * @return string A hash of the session token (a verifier). */ final private function hash_token( $token ) { - return hash( 'sha256', $token ); + // If ext/hash is not present, use sha1() instead. + if ( function_exists( 'hash' ) ) { + return hash( 'sha256', $token ); + } else { + return sha1( $token ); + } } /**