Ticket #5367: auth.diff

wp-admin/includes/misc.php

@@ -140 +140 @@
-        // Clear cookies for old paths.
-        wp_clearcookie();
-        // Set cookies for new paths.
-
+
+
-}
-
-add_action( 'update_option_home', 'update_home_siteurl', 10, 2 );

wp-includes/pluggable.php

@@ -46 +46 @@
-        if ( ! empty($current_user) )
-                return;
-
-PASS
-login($_COOKIE[USER_COOKIE], $_COOKIE[PASS_COOKIE], true
+AUTH
+validatecookie($_COOKIE[USER_COOKIE], $_COOKIE[AUTH_COOKIE]
-                wp_set_current_user(0);
-                return false;
-        }
@@ -293 +293 @@
-endif;
-
-if ( !function_exists('wp_login') ) :
-already_md5 = false
-wpdb, $
+deprecated
+
-
-        $username = sanitize_user($username);
-
-        if ( '' == $username )
-                return false;
-
-        if ( '' == $password ) {
-                $error = __('<strong>ERROR</strong>: The password field is empty.');
-                return false;
-        }
-
-        $login = get_userdatabylogin($username);
-        //$login = $wpdb->get_row("SELECT ID, user_login, user_pass FROM $wpdb->users WHERE user_login = '$username'");
-
-        if (!$login) {
-                $error = __('<strong>ERROR</strong>: Invalid username.');
-                return false;
-        } else {
-
-
-
+
-                        return true;
-                } else {
-                        $error = __('<strong>ERROR</strong>: Incorrect password.');
@@ -340 +332 @@
-function auth_redirect() {
-        // Checks if a user is logged in, if not redirects them to the login page
-        if ( (!empty($_COOKIE[USER_COOKIE]) &&
-login($_COOKIE[USER_COOKIE], $_COOKIE[PASS_COOKIE], true
+validatecookie($_COOKIE[USER_COOKIE], $_COOKIE[AUTH_COOKIE]
-                         (empty($_COOKIE[USER_COOKIE])) ) {
-                nocache_headers();
-
-
+auth=expired&
-                exit();
-        }
-}
@@ -376 +368 @@
-                foreach ( $cookie as $tasty ) {
-                        if ( false !== strpos($tasty, USER_COOKIE) )
-                                $user = substr(strstr($tasty, '='), 1);
-PASS
+AUTH
-                                $pass = substr(strstr($tasty, '='), 1);
-                }
-
-login( $user, $pass, true
+validatecookie( $user, $pass
-                        die('-1');
-        }
-        do_action('check_ajax_referer');
@@ -473 +465 @@
-
-if ( !function_exists('wp_setcookie') ) :
-function wp_setcookie($username, $password, $already_md5 = false, $home = '', $siteurl = '', $remember = false) {
-        if ( !$already_md5 )
-                $password = md5( md5($password) ); // Double hash the password in the cookie.
-
+        $user = get_userdatabylogin($username);
+        //Generate a new authentication cookie.
+        $auth = wp_hash(wp_salt() . $username . uniqid( microtime() ));
+        update_usermeta($user->ID, 'wp_authentication_cookie', wp_hash($auth) ) ;
+        
-        if ( empty($home) )
-                $cookiepath = COOKIEPATH;
-        else
@@ -495 +490 @@
-                $expire = 0;
-
-        setcookie(USER_COOKIE, $username, $expire, $cookiepath, COOKIE_DOMAIN);
-
+
+
-
-        if ( $cookiepath != $sitecookiepath ) {
-                setcookie(USER_COOKIE, $username, $expire, $sitecookiepath, COOKIE_DOMAIN);
-
+
+
-        }
-}
-endif;
@@ -508 +505 @@
-function wp_clearcookie() {
-        setcookie(USER_COOKIE, ' ', time() - 31536000, COOKIEPATH, COOKIE_DOMAIN);
-        setcookie(PASS_COOKIE, ' ', time() - 31536000, COOKIEPATH, COOKIE_DOMAIN);
+        setcookie(AUTH_COOKIE, ' ', time() - 31536000, COOKIEPATH, COOKIE_DOMAIN);
-        setcookie(USER_COOKIE, ' ', time() - 31536000, SITECOOKIEPATH, COOKIE_DOMAIN);
-        setcookie(PASS_COOKIE, ' ', time() - 31536000, SITECOOKIEPATH, COOKIE_DOMAIN);
+        setcookie(AUTH_COOKIE, ' ', time() - 31536000, SITECOOKIEPATH, COOKIE_DOMAIN);
-}
-endif;
-
@@ -700 +699 @@
-}
-endif;
-
+if ( !function_exists('wp_validatecookie') ) :
+function wp_validatecookie($username, $auth_cookie) {
+        global $error;
+
+        $login = get_userdatabylogin($username);
+
+        if (!$login) {
+                $error = __('<strong>ERROR</strong>: Invalid username.');
+                return false;
+        } else {
+                $auth = get_usermeta($login->ID, "wp_authentication_cookie" );
+                if ( ( '' != $auth ) && ($login->user_login == $username ) && ( wp_hash( $auth_cookie ) == $auth ) ) {
+                        return true;
+                } else {
+                        wp_clearcookie();
+                        $error = __('<strong>ERROR</strong>: Authentication Cookie Invalid.');
+                        return false;
+                }
+        }
+}
+endif;
+
+
+
+
+
+
+
-?>

wp-login.php

@@ -345 +345 @@
-        elseif  ( 'confirm' == $_GET['checkemail'] )    $errors['confirm']                      = __('Check your e-mail for the confirmation link.');
-        elseif  ( 'newpass' == $_GET['checkemail'] )    $errors['newpass']                      = __('Check your e-mail for your new password.');
-        elseif  ( 'registered' == $_GET['checkemail'] ) $errors['registered']           = __('Registration complete. Please check your e-mail.');
+        elseif  ( 'expired' == $_GET['auth'] )                  $errors['auth']                         = __('Your cookie has expired please log back in.');
-
-        login_header(__('Login'));
-?>

wp-settings.php

@@ -189 +189 @@
-        define('USER_COOKIE', 'wordpressuser_'. COOKIEHASH);
-if ( !defined('PASS_COOKIE') )
-        define('PASS_COOKIE', 'wordpresspass_'. COOKIEHASH);
-
+
+
+
-        define('TEST_COOKIE', 'wordpress_test_cookie');
-if ( !defined('COOKIEPATH') )
-        define('COOKIEPATH', preg_replace('|https?://[^/]+|i', '', get_option('home') . '/' ) );