Get WordPress

Plugin Directory

Changeset 2942064

Timestamp:
07/23/2023 11:11:41 AM (13 months ago)
Author:
ayeshrajans
Message:

Add v3.0.0

Location:
password-hash
Files:
7 added
4 edited

Legend:

Unmodified
Added
Removed

  • password-hash/trunk/composer.json

    r2149096 r2942064  
    88    {
    99      "name": "Ayesh Karunaratne",
    10       "email": "ayesh@ayesh.me",
    11       "homepage": "https://ayesh.me"
     10      "email": "ayesh@aye",
     11      "homepage": "https://aye"
    1212    }
    1313  ],
    … …  
    1717  },
    1818  "require": {
    19     "php": ">=5.5.0",
     19    "php": ">=.0",
    2020    "composer/installers": "~1.0"
    2121  },
    … …  
    2424      "Ayesh\\WP_PasswordHash\\": "src/"
    2525    },
    26     "files": ["wp-php-password-hash.php"]
     26    "files": [
     27      "wp-php-password-hash.php"
     28    ]
    2729  }
    2830}

  • password-hash/trunk/readme.txt

    r2714540 r2942064  
    1 === PHP Native password hash ===
     1=== PHP Native ash ===
    22Contributors: ayeshrajans
    33Tags: password, password hashing, password_hash, bcrypt, argon2, argon2i, argon2id, sodium, password security, security
    4 Requires at least: 3.9.2
    5 Tested up to: 6.0
    6 Stable tag: 2.1
    7 Requires PHP: 5.5
     4Requires at least: .2
     5Tested up to: 6.
     6Stable tag:
     7Requires PHP:
    88License: GPLv2 or later
    99License URI: https://www.gnu.org/licenses/gpl-2.0.html
    … …  
    2222*  PHP might come up with newer password hashing algorithms, and they will be automatically supported without having to reset all the passwords.
    2323
    24 This plugin was made initially because one of our applications used Wordpress for authentication, but we needed to use an external system
    25 to verify the passwords directly from the database too. Since Wordpress has its own password hashing algorithm, we decided to make this plugin to address that problem.
    26 With this plugin, passwords generated by both Wordpress and other custom applications now use the PHP's default `password_hash()` functions without compromising any of the applications security.
     24This plugin was made initially because one of our applications used Wordress for authentication, but we needed to use an external system
     25to verify the passwords directly from the database too. Since Wordress has its own password hashing algorithm, we decided to make this plugin to address that problem.
     26With this plugin, passwords generated by both Word security.
    2727
    2828== Installation ==
    … …  
    5050The easiest way would be to check your database from PHPMyAdmin or any other software in its line. Check if the password
    5151hash field in your users table has the format `$2y$10...`. Those who have not updated their hashes will have a different
    52 format. However, if the plugin is unable to override the password hashing algorithm from Wordpress core, you will see a
     52format. However, if the plugin is unable to override the password hashing algorithm from Wordress core, you will see a
    5353notification in your dashboard. If you do not see anything, you are golden.
    5454
    … …  
    6060Open your `wp-config.php` file at the root of your WordPress site, and find the line that says `That's all, stop editing! Happy publishing`.
    6161Above this line, you can configure the hashing algorithm you want this plugin to use. Note that a wrong configuration value
    62 means your users will not be able to login until you fix this configuration option. It's not recommended that you set
     62means your users will not be able to login until you fix this configuration option. It's not recommended that you set
    6363this configuration value unless you know what you are doing.
    6464
    … …  
    104104
    105105= 1.2 =
    106 * This plugin now requires Wordpress minimum version 3.9.2 the least, and uses the hash_equals() function polyfill provided by Wordpress core.
     106* This plugin now requires Wordress core.
    107107
    108108= 1.4 =
    109109* Skipped 1.3 version because a WIP Argon2i support conflicted with the bug fix (#2). Argon2i support will be added in a future release.
    110 * Fixes an error with password validation when the PasswordHash class from Wordpress core is not loaded. See https://github.com/Ayesh/wordpress-password-hash/pull/2
     110* Fixes an error with password validation when the PasswordHash class from Wordress core is not loaded. See https://github.com/Ayesh/wordpress-password-hash/pull/2
    111111
    112112= 1.5 =
    … …  
    118118Core functionality of the plugin is extracted to a separate class. This plugin aims to be as light-weight as possible, and this version cuts the main plugin file size to less than half the v1.x size.
    119119
    120 There is a new namespaced PasswordHash class that is more cleaner and well-structured compared to our v1 code base.
     120There is a new namespaced PasswordHash class that is cleaner and well-structured compared to our v1 code base.
    121121
    122 * Fixes a bug that the hook-provided hash cost changes did not trigger a password rehash. Thanks to Steve Thomas (Sc00bz on Github).
     122* Fixes a bug that the hook-provided hash cost changes did not trigger a password rehash. Thanks to Steve Thomas (Sc00bz on Gitub).
    123123* Adds support for Argon2I, Argon2ID and any future hashing algorithms PHP will introduce. See the updated FAQ item on how to use the new hashing algorithms.
    124124* Removed a helper function used to trigger an admin warning if the plugin cannot properly work. The notices are now shown with help of lambda functions (which further reduces the code bloat and load).
    … …  
    127127* Adds support for "WP_PASSWORD_HASH_OPTIONS" configuration option that can be set in `wp-config.php` to configure password hashing options.
    128128* Update WordPress core "Tested up to" field to WordPress 5.6.
     129
     130
     131
     132
     133
     134

  • password-hash/trunk/src/PasswordHash.php

    r2401236 r2942064  
    33namespace Ayesh\WP_PasswordHash;
    44
     5
     6
     7
     8
     9
     10
     11
     12
     13
     14
     15
     16
     17
     18
     19
     20
     21
     22
     23
     24
     25
    526final class PasswordHash {
    6     private $algorithm = \PASSWORD_DEFAULT;
     27    private $algorithm = PASSWORD_DEFAULT;
    728    private $algorithm_options = [];
    829    private $wpdb;
    930    const TEXT_DOMAIN = 'password-hash';
    1031
    11     public function __construct(\wpdb $wpdb) {
     32    public function __construct(wpdb $wpdb) {
    1233        $this->wpdb = $wpdb;
    1334        $this->initializePasswordConfig();
    … …  
    1536
    1637    private function initializePasswordConfig() {
    17         if (\defined('WP_PASSWORD_HASH_ALGO')) {
    18             $this->algorithm = \WP_PASSWORD_HASH_ALGO;
     38        if (defined('WP_PASSWORD_HASH_ALGO')) {
     39            $this->algorithm = WP_PASSWORD_HASH_ALGO;
    1940
    20             if (\defined('WP_PASSWORD_HASH_OPTIONS') && is_array(\WP_PASSWORD_HASH_OPTIONS)) {
    21                 $this->algorithm_options = \WP_PASSWORD_HASH_OPTIONS;
     41            if (WP_PASSWORD_HASH_OPTIONS)) {
     42                $this->algorithm_options = WP_PASSWORD_HASH_OPTIONS;
    2243            }
    23             $this->algorithm_options = \apply_filters( 'wp_php_password_hash_options', $this->algorithm_options );
     44            $this->algorithm_options = apply_filters( 'wp_php_password_hash_options', $this->algorithm_options );
    2445        }
    2546    }
    … …  
    2748    public static function setAdminWarning($message) {
    2849        $message = __($message, self::TEXT_DOMAIN);
    29         \add_action( 'admin_notices', static function () use ($message) {
     50        add_action( 'admin_notices', static function () use ($message) {
    3051                print "<div class='notice notice-error'><p>{$message}</p></div>";
    3152            }
    … …  
    4869     *
    4970     */
    50     public function checkPassword($password, $hash, $user_id = '') {
     71    public function checkPassword($password, $hash, $user_id = '') {
    5172        // Check if the hash uses Password API.
    52         $info = \password_get_info($hash);
     73        $info = password_get_info($hash);
    5374        if (!empty($info['algo'])) {
    5475            return $this->checkPasswordNative($password, $hash, $user_id);
    … …  
    5677
    5778        // Is it god forbid MD5?
    58         if ( \strlen($hash) <= 32 ) {
     79        if ( strlen($hash) <= 32 ) {
    5980            return $this->checkPasswordMD5($password, $hash, $user_id);
    6081        }
    … …  
    7192     */
    7293    public function getHash($password) {
    73         return \password_hash($password, $this->algorithm, $this->algorithm_options);
     94        return password_hash($password, $this->algorithm, $this->algorithm_options);
    7495    }
    7596
    … …  
    87108        $this->wpdb->update($this->wpdb->users, $fields, $conditions);
    88109
    89         \wp_cache_delete( $user_id, 'users' );
     110        wp_cache_delete( $user_id, 'users' );
    90111
    91112        return $hash;
    … …  
    93114
    94115    private function checkPasswordNative($password, $hash, $user_id = '') {
    95         $check = \password_verify($password, $hash);
    96         $rehash = \password_needs_rehash($hash, $this->algorithm, $this->algorithm_options);
     116        $check = password_verify($password, $hash);
     117        $rehash = password_needs_rehash($hash, $this->algorithm, $this->algorithm_options);
    97118        return $this->processPasswordCheck($check, $password, $hash, $user_id, $rehash);
    98119    }
    99120
    100121    private function checkPasswordMD5($password, $hash, $user_id = '') {
    101         $check = \hash_equals( $hash, \md5( $password ) );
     122        $check = md5( $password ) );
    102123        return $this->processPasswordCheck($check, $password, $hash, $user_id);
    103124    }
    … …  
    107128
    108129        if ( empty($wp_hasher) ) {
    109             if( !\class_exists('PasswordHash') ) {
     130            if( !class_exists('PasswordHash') ) {
    110131                require_once ABSPATH . WPINC . '/class-phpass.php';
    111132            }
    … …  
    122143        }
    123144
    124         return \apply_filters( 'check_password', $check, $password, $hash, $user_id );
     145        return apply_filters( 'check_password', $check, $password, $hash, $user_id );
    125146    }
    126147}

  • password-hash/trunk/wp-php-password-hash.php

    r2151003 r2942064  
    11<?php
    22/**
    3  * Plugin Name: PHP native password hash
    4  * Version:     2.1
     3 * Plugin Name: PHP ash
     4 * Version:     
    55 * Description: Swaps out WordPress's password hashing mechanism with PHP 5.5's `password_hash()` functions set, and automatically rehashes the existing passwords on users next successful login. Provides safety against dictionary attacks, time-attacks, brute-force attacks.
    66 * Licence:     GPLv2 or later
    77 * Author:      Ayesh Karunaratne
    8  * Author URI:  https://ayesh.me/open-source
     8 * Author URI:  https://aye/open-source
    99 */
     10
     11
    1012
    1113if ( function_exists( 'wp_hash_password' ) ) {
    … …  
    2022 * @return \Ayesh\WP_PasswordHash\PasswordHash
    2123 */
    22 function wp_password_hash_include() {
     24function wp_password_hash_include() {
    2325    static $hasher;
    2426    require_once __DIR__ . '/src/PasswordHash.php';
    2527    if ( ! $hasher ) {
    2628        global $wpdb;
    27         $hasher = new \Ayesh\WP_PasswordHash\PasswordHash( $wpdb );
     29        $hasher = new PasswordHash( $wpdb );
    2830    }
    2931
    … …  
    3436 * The function calls below override the WordPress-provided functions.
    3537 *
    36  * All of the plugin functionality is contained in @see
     38 * All the plugin functionality is contained in @see
    3739 * \Ayesh\WP_PasswordHash\PasswordHash class. Check the called proxy method for
    3840 * further documentation.
    … …  
    4143if ( ! function_exists( 'wp_hash_password' ) && function_exists( 'password_hash' ) ) :
    4244
    43     function wp_check_password( $password, $hash, $user_id = '' ) {
    44         $hasher = wp_password_hash_include();
    45         return $hasher->checkPassword( $password, $hash, $user_id );
     45    function wp_check_password( $password, $hash, $user_id = '' ): bool {
     46        return wp_password_hash_include()->checkPassword( $password, $hash, $user_id );
    4647    }
    4748
    4849    function wp_hash_password( $password ) {
    49         $hasher = wp_password_hash_include();
    50         return $hasher->getHash( $password );
     50        return wp_password_hash_include()->getHash( $password );
    5151    }
    5252
    5353    function wp_set_password( $password, $user_id ) {
    54         $hasher = wp_password_hash_include();
    55         return $hasher->updateHash( $password, $user_id );
     54        return wp_password_hash_include()->updateHash( $password, $user_id );
    5655    }
    5756
Note: See TracChangeset for help on using the changeset viewer.