Upstream/WordPress
1
0
Fork 0
mirror of https://github.com/WordPress/WordPress.git synced 2024-12-22 09:07:59 +01:00
Code Issues Projects Releases Wiki Activity

External Libraries: Update PHPass library.

Browse Source 
This updates the PHPass library to version `0.5.4` while maintaining the adjustments introduced in [30466].

Props jrf.
Fixes #62058.
Built from https://develop.svn.wordpress.org/trunk@59030


git-svn-id: http://core.svn.wordpress.org/trunk@58426 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
desrosj 2024-09-17 21:08:16 +00:00
parent 56eb5c22d8
commit 7629bd782d
2 changed files with 33 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

50
wp-includes/class-phpass.php
View File

@ -10,7 +10,7 @@
# #
# Portable PHP password hashing framework. # Portable PHP password hashing framework.
# #
# Version 0.5 / WordPress. # Version 0.5.4 / WordPress.
# #
# Written by Solar Designer <solar at openwall.com> in 2004-2006 and placed in # Written by Solar Designer <solar at openwall.com> in 2004-2006 and placed in
# the public domain. Revised in subsequent years, still public domain. # the public domain. Revised in subsequent years, still public domain.
@ -51,15 +51,17 @@ class PasswordHash {
{ {
$this->itoa64 = './0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz'; $this->itoa64 = './0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz';
if ($iteration_count_log2 < 4 || $iteration_count_log2 > 31) if ($iteration_count_log2 < 4 || $iteration_count_log2 > 31) {
$iteration_count_log2 = 8; $iteration_count_log2 = 8;
}
$this->iteration_count_log2 = $iteration_count_log2; $this->iteration_count_log2 = $iteration_count_log2;
$this->portable_hashes = $portable_hashes; $this->portable_hashes = $portable_hashes;
$this->random_state = microtime(); $this->random_state = microtime();
if (function_exists('getmypid')) if (function_exists('getmypid')) {
$this->random_state .= getmypid(); $this->random_state .= getmypid();
}
} }
function PasswordHash($iteration_count_log2, $portable_hashes) function PasswordHash($iteration_count_log2, $portable_hashes)
@ -96,16 +98,20 @@ class PasswordHash {
do { do {
$value = ord($input[$i++]); $value = ord($input[$i++]);
$output .= $this->itoa64[$value & 0x3f]; $output .= $this->itoa64[$value & 0x3f];
if ($i < $count) if ($i < $count) {
$value |= ord($input[$i]) << 8; $value |= ord($input[$i]) << 8;
}
$output .= $this->itoa64[($value >> 6) & 0x3f]; $output .= $this->itoa64[($value >> 6) & 0x3f];
if ($i++ >= $count) if ($i++ >= $count) {
break; break;
if ($i < $count) }
if ($i < $count) {
$value |= ord($input[$i]) << 16; $value |= ord($input[$i]) << 16;
}
$output .= $this->itoa64[($value >> 12) & 0x3f]; $output .= $this->itoa64[($value >> 12) & 0x3f];
if ($i++ >= $count) if ($i++ >= $count) {
break; break;
}
$output .= $this->itoa64[($value >> 18) & 0x3f]; $output .= $this->itoa64[($value >> 18) & 0x3f];
} while ($i < $count); } while ($i < $count);
@ -115,8 +121,8 @@ class PasswordHash {
function gensalt_private($input) function gensalt_private($input)
{ {
$output = '$P$'; $output = '$P$';
$output .= $this->itoa64[min($this->iteration_count_log2 + $output .= $this->itoa64[min($this->iteration_count_log2 + 5,
((PHP_VERSION >= '5') ? 5 : 3), 30)]; 30)];
$output .= $this->encode64($input, 6); $output .= $this->encode64($input, 6);
return $output; return $output;
@ -125,23 +131,27 @@ class PasswordHash {
function crypt_private($password, $setting) function crypt_private($password, $setting)
{ {
$output = '*0'; $output = '*0';
if (substr($setting, 0, 2) === $output) if (substr($setting, 0, 2) === $output) {
$output = '*1'; $output = '*1';
}
$id = substr($setting, 0, 3); $id = substr($setting, 0, 3);
# We use "$P$", phpBB3 uses "$H$" for the same thing # We use "$P$", phpBB3 uses "$H$" for the same thing
if ($id !== '$P$' && $id !== '$H$') if ($id !== '$P$' && $id !== '$H$') {
return $output; return $output;
}
$count_log2 = strpos($this->itoa64, $setting[3]); $count_log2 = strpos($this->itoa64, $setting[3]);
if ($count_log2 < 7 || $count_log2 > 30) if ($count_log2 < 7 || $count_log2 > 30) {
return $output; return $output;
}
$count = 1 << $count_log2; $count = 1 << $count_log2;
$salt = substr($setting, 4, 8); $salt = substr($setting, 4, 8);
if (strlen($salt) !== 8) if (strlen($salt) !== 8) {
return $output; return $output;
}
# We were kind of forced to use MD5 here since it's the only # We were kind of forced to use MD5 here since it's the only
# cryptographic primitive that was available in all versions # cryptographic primitive that was available in all versions
@ -174,7 +184,7 @@ class PasswordHash {
$output = '$2a$'; $output = '$2a$';
$output .= chr((int)(ord('0') + $this->iteration_count_log2 / 10)); $output .= chr((int)(ord('0') + $this->iteration_count_log2 / 10));
$output .= chr((ord('0') + $this->iteration_count_log2 % 10)); $output .= chr(ord('0') + $this->iteration_count_log2 % 10);
$output .= '$'; $output .= '$';
$i = 0; $i = 0;
@ -213,17 +223,20 @@ class PasswordHash {
$random = $this->get_random_bytes(16); $random = $this->get_random_bytes(16);
$hash = $hash =
crypt($password, $this->gensalt_blowfish($random)); crypt($password, $this->gensalt_blowfish($random));
if (strlen($hash) === 60) if (strlen($hash) === 60) {
return $hash; return $hash;
}
} }
if (strlen($random) < 6) if (strlen($random) < 6) {
$random = $this->get_random_bytes(6); $random = $this->get_random_bytes(6);
}
$hash = $hash =
$this->crypt_private($password, $this->crypt_private($password,
$this->gensalt_private($random)); $this->gensalt_private($random));
if (strlen($hash) === 34) if (strlen($hash) === 34) {
return $hash; return $hash;
}
# Returning '*' on error is safe here, but would _not_ be safe # Returning '*' on error is safe here, but would _not_ be safe
# in a crypt(3)-like function used _both_ for generating new # in a crypt(3)-like function used _both_ for generating new
@ -238,8 +251,9 @@ class PasswordHash {
} }
$hash = $this->crypt_private($password, $stored_hash); $hash = $this->crypt_private($password, $stored_hash);
if ($hash[0] === '*') if ($hash[0] === '*') {
$hash = crypt($password, $stored_hash); $hash = crypt($password, $stored_hash);
}
# This is not constant-time. In order to keep the code simple, # This is not constant-time. In order to keep the code simple,
# for timing safety we currently rely on the salts being # for timing safety we currently rely on the salts being

2
wp-includes/version.php
View File

@ -16,7 +16,7 @@
* *
* @global string $wp_version * @global string $wp_version
*/ */
$wp_version = '6.7-alpha-59029'; $wp_version = '6.7-alpha-59030';
/** /**
* Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema. * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.