Ticket #5367: secure_cookie.5.diff

wp-login.php

@@ -288 +288 @@
-default:
-        $user_login = '';
-        $user_pass = '';
-        $using_cookie = FALSE;
-
-        if ( !isset( $_REQUEST['redirect_to'] ) || is_user_logged_in() )
-                $redirect_to = 'wp-admin/';
@@ -296 +295 @@
-                $redirect_to = $_REQUEST['redirect_to'];
-
-        if ( $http_post ) {
+                // If cookies are disabled we can't log in even with a valid user+pass
+                if ( empty($_COOKIE[TEST_COOKIE]) )
+                        $errors['test_cookie'] = __('<strong>ERROR</strong>: WordPress requires Cookies but your browser does not support them or they are blocked.');
+                
-                $user_login = $_POST['log'];
-                $user_login = sanitize_user( $user_login );
-                $user_pass  = $_POST['pwd'];
-                $rememberme = $_POST['rememberme'];
+
+                do_action_ref_array('wp_authenticate', array(&$user_login, &$user_pass));
-        } else {
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
-                }
-        }
-
-        do_action_ref_array('wp_authenticate', array(&$user_login, &$user_pass));
-
-        // If cookies are disabled we can't log in even with a valid user+pass
-        if ( $http_post && empty($_COOKIE[TEST_COOKIE]) )
-                $errors['test_cookie'] = __('<strong>ERROR</strong>: WordPress requires Cookies but your browser does not support them or they are blocked.');
-
-        if ( $user_login && $user_pass && empty( $errors ) ) {
-                $user = new WP_User(0, $user_login);
-
@@ -322 +327 @@
-                if ( !$user->has_cap('edit_posts') && ( empty( $redirect_to ) || $redirect_to == 'wp-admin/' ) )
-                        $redirect_to = get_option('siteurl') . '/wp-admin/profile.php';
-
-
-
-
+
+
-                        do_action('wp_login', $user_login);
-                        wp_safe_redirect($redirect_to);
-                        exit();
-                } else {
-                        if ( $using_cookie )
-                                $errors['expiredsession'] = __('Your session has expired.');
-                }
-        }
-

wp-includes/compat.php

@@ -147 +147 @@
-        }
-}
-
+if ( ! function_exists('hash_hmac') ):
+function hash_hmac($algo, $data, $key, $raw_output = false) {
+        $packs = array('md5' => 'H32', 'sha1' => 'H40');
+
+        if ( !isset($packs[$algo]) )
+                return false;
+
+        $pack = $packs[$algo];
+
+        if (strlen($key) > 64)
+                $key = pack($pack, $algo($key));
+        else if (strlen($key) < 64)
+                $key = str_pad($key, 64, chr(0));
+        
+        $ipad = (substr($key, 0, 64) ^ str_repeat(chr(0x36), 64));
+        $opad = (substr($key, 0, 64) ^ str_repeat(chr(0x5C), 64));
+
+        return $algo($opad . pack($pack, $algo($ipad . $data)));
+}
+endif;
+
-// Added in PHP 4.3.0?
-if (!defined('IMAGETYPE_GIF'))
-    define('IMAGETYPE_GIF', 1);

wp-includes/pluggable.php

@@ -46 +46 @@
-        if ( ! empty($current_user) )
-                return;
-
-
-
+
-                wp_set_current_user(0);
-                return false;
-        }
-
-
-
+
-}
-endif;
-
@@ -293 +291 @@
-endif;
-
-if ( !function_exists('wp_login') ) :
-already_md5
+deprecated
-        global $wpdb, $error;
-
-        $username = sanitize_user($username);
@@ -313 +311 @@
-                return false;
-        }
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-        } else {
-if ( md5($login->user_pass) == $password )
-       return true
+$expiration = time() + 172800;
+$expire = 0
-        }
-
-
-
+
+
+
+
+
+
+
+
-}
-endif;
-
+if ( !function_exists('wp_clear_auth_cookie') ) :
+function wp_clear_auth_cookie() {
+        setcookie(AUTH_COOKIE, ' ', time() - 31536000, COOKIEPATH, COOKIE_DOMAIN);
+        setcookie(AUTH_COOKIE, ' ', time() - 31536000, SITECOOKIEPATH, COOKIE_DOMAIN);
+
+        // Old cookies
+        setcookie(USER_COOKIE, ' ', time() - 31536000, COOKIEPATH, COOKIE_DOMAIN);
+        setcookie(PASS_COOKIE, ' ', time() - 31536000, COOKIEPATH, COOKIE_DOMAIN);
+        setcookie(USER_COOKIE, ' ', time() - 31536000, SITECOOKIEPATH, COOKIE_DOMAIN);
+        setcookie(PASS_COOKIE, ' ', time() - 31536000, SITECOOKIEPATH, COOKIE_DOMAIN);  
+}
+endif;
+
-if ( !function_exists('is_user_logged_in') ) :
-function is_user_logged_in() {
-        $user = wp_get_current_user();
@@ -350 +409 @@
-if ( !function_exists('auth_redirect') ) :
-function auth_redirect() {
-        // Checks if a user is logged in, if not redirects them to the login page
-USER
-login($_COOKIE[USER_COOKIE], $_COOKIE[PASS_COOKIE], true
-USER
+AUTH
+validate_auth_cookie($_COOKIE[AUTH_COOKIE]
+AUTH
-                nocache_headers();
-
-                wp_redirect(get_option('siteurl') . '/wp-login.php?redirect_to=' . urlencode($_SERVER['REQUEST_URI']));
@@ -379 +438 @@
-        if ( !wp_verify_nonce( $nonce, $action ) ) {
-                $current_name = '';
-                if ( ( $current = wp_get_current_user() ) && $current->ID )
-data->
+
-                if ( !$current_name )
-                        die('-1');
-
+                $auth_cookie = '';
-                $cookie = explode('; ', urldecode(empty($_POST['cookie']) ? $_GET['cookie'] : $_POST['cookie'])); // AJAX scripts must pass cookie=document.cookie
-                foreach ( $cookie as $tasty ) {
-
-
-
-
+
+
-                }
-
-!wp_login( $user, $pass, tru
+empty($auth_cookie) || !wp_validate_auth_cookie( $auth_cooki
-                        die('-1');
-        }
-        do_action('check_ajax_referer');
@@ -472 +530 @@
-}
-endif;
-
-if ( !function_exists('wp_get_cookie_login') ):
-function wp_get_cookie_login() {
-        if ( empty($_COOKIE[USER_COOKIE]) || empty($_COOKIE[PASS_COOKIE]) )
-                return false;
-
-        return array('login' => $_COOKIE[USER_COOKIE],  'password' => $_COOKIE[PASS_COOKIE]);
-}
-
-endif;
-
-if ( !function_exists('wp_setcookie') ) :
-function wp_setcookie($username, $password, $already_md5 = false, $home = '', $siteurl = '', $remember = false) {
-        $user = get_userdatabylogin($username);
-        if ( !$already_md5) {
-                $password = md5($user->user_pass); // Double hash the password in the cookie.
-        }
-
-        if ( empty($home) )
-                $cookiepath = COOKIEPATH;
-        else
-                $cookiepath = preg_replace('|https?://[^/]+|i', '', $home . '/' );
-
-        if ( empty($siteurl) ) {
-                $sitecookiepath = SITECOOKIEPATH;
-                $cookiehash = COOKIEHASH;
-        } else {
-                $sitecookiepath = preg_replace('|https?://[^/]+|i', '', $siteurl . '/' );
-                $cookiehash = md5($siteurl);
-        }
-
-        if ( $remember )
-                $expire = time() + 31536000;
-        else
-                $expire = 0;
-
-        setcookie(USER_COOKIE, $username, $expire, $cookiepath, COOKIE_DOMAIN);
-        setcookie(PASS_COOKIE, $password, $expire, $cookiepath, COOKIE_DOMAIN);
-
-        if ( $cookiepath != $sitecookiepath ) {
-                setcookie(USER_COOKIE, $username, $expire, $sitecookiepath, COOKIE_DOMAIN);
-                setcookie(PASS_COOKIE, $password, $expire, $sitecookiepath, COOKIE_DOMAIN);
-        }
-}
-endif;
-
-if ( !function_exists('wp_clearcookie') ) :
-function wp_clearcookie() {
-        setcookie(USER_COOKIE, ' ', time() - 31536000, COOKIEPATH, COOKIE_DOMAIN);
-        setcookie(PASS_COOKIE, ' ', time() - 31536000, COOKIEPATH, COOKIE_DOMAIN);
-        setcookie(USER_COOKIE, ' ', time() - 31536000, SITECOOKIEPATH, COOKIE_DOMAIN);
-        setcookie(PASS_COOKIE, ' ', time() - 31536000, SITECOOKIEPATH, COOKIE_DOMAIN);
-}
-endif;
-
-if ( ! function_exists('wp_notify_postauthor') ) :
-function wp_notify_postauthor($comment_id, $comment_type='') {
-        $comment = get_comment($comment_id);
@@ -692 +696 @@
-if ( !function_exists('wp_salt') ) :
-function wp_salt() {
-        $salt = get_option('secret');
-
-
+
+
+
+
-
-
+
+
+
+
+
+
-}
-endif;
-
@@ -758 +769 @@
-        return $password;
-}
-endif;
+
+// Deprecated. Use wp_set_auth_cookie()
+if ( !function_exists('wp_setcookie') ) :
+function wp_setcookie($username, $password = '', $already_md5 = false, $home = '', $siteurl = '', $remember = false) {
+        $user = get_userdatabylogin($username);
+        wp_set_auth_cookie($user->ID, $remember);
+}
+endif;
+
+// Deprecated. Use wp_clear_auth_cookie()
+if ( !function_exists('wp_clearcookie') ) :
+function wp_clearcookie() {
+        wp_clear_auth_cookie();
+}
+endif;
+
+// Deprecated.  No alternative.
+if ( !function_exists('wp_get_cookie_login') ):
+function wp_get_cookie_login() {
+        return false;
+}
+endif;
+
-?>

wp-includes/registration.php

@@ -167 +167 @@
-        $current_user = wp_get_current_user();
-        if ( $current_user->id == $ID ) {
-                if ( isset($plaintext_pass) ) {
-
-cookie($userdata['user_login'], $plaintext_pass
+_auth_
+_auth_cookie($ID
-                }
-        }
-

wp-config-sample.php

@@ -6 +6 @@
-define('DB_HOST', 'localhost');    // 99% chance you won't need to change this value
-define('DB_CHARSET', 'utf8');
-define('DB_COLLATE', '');
+define('SECRET_KEY', ''); // Change this to a unique phrase.
-
-// You can have multiple installations in one database if you give each a unique prefix
-$table_prefix  = 'wp_';   // Only numbers, letters, and underscores please!

wp-settings.php

@@ -186 +186 @@
-}
-
-if ( !defined('USER_COOKIE') )
-
+ 
-if ( !defined('PASS_COOKIE') )
-
+
+
+
-if ( !defined('TEST_COOKIE') )
-        define('TEST_COOKIE', 'wordpress_test_cookie');
-if ( !defined('COOKIEPATH') )

wp-admin/includes/misc.php

@@ -128 +128 @@
-        update_option( 'recently_edited', $oldfiles );
-}
-
-reset cookies and 
+
-function update_home_siteurl( $old_value, $value ) {
-        global $wp_rewrite, $user_login, $user_pass_md5;
-
@@ -137 +137 @@
-
-        // If home changed, write rewrite rules to new location.
-        $wp_rewrite->flush_rules();
-        // Clear cookies for old paths.
-        wp_clearcookie();
-        // Set cookies for new paths.
-        wp_setcookie( $user_login, $user_pass_md5, true, get_option( 'home' ), get_option( 'siteurl' ));
-}
-
-add_action( 'update_option_home', 'update_home_siteurl', 10, 2 );