Changeset 10800

Timestamp:

05/24/2016 02:34:37 PM (8 years ago)

Author:

boonebgorges

Message:

Better hash building for activation keys, password reset keys, and filenames.

There is no need to use user-facing info for these hashes.

Props DJPaul, vortfu.

Location:

trunk

Files:

• src/bp-core/classes/class-bp-attachment-avatar.php (modified) (1 diff)
• src/bp-core/classes/class-bp-attachment-cover-image.php (modified) (1 diff)
• src/bp-members/bp-members-functions.php (modified) (4 diffs)
• src/bp-members/bp-members-screens.php (modified) (1 diff)
• src/bp-members/classes/class-bp-signup.php (modified) (1 diff)
• src/bp-settings/bp-settings-actions.php (modified) (1 diff)
• tests/phpunit/testcases/members/functions.php (modified) (2 diffs)

trunk/src/bp-core/classes/class-bp-attachment-avatar.php

@@ -293 +293 @@
             }
 
-            $args['dst_file'] = $avatar_folder_dir . '/' . wp_hash( $absolute_path . time() ) . '-bp' . $key_type . '.' . $ext;
+            $filename         = wp_unique_filename( $avatar_folder_dir, uniqid() . "-bp{$key_type}.{$ext}" );
+            $args['dst_file'] = $avatar_folder_dir . '/' . $filename;
 
             $avatar_types[ $key_type ] = parent::crop( $args );

trunk/src/bp-core/classes/class-bp-attachment-cover-image.php

@@ -209 +209 @@
         }
 
-        $info    = pathinfo( $file );
-        $dir     = $info['dirname'];
-        $ext     = strtolower( $info['extension'] );
-        $name    = wp_hash( $file . time() ) . '-bp-cover-image';
-
-        return trailingslashit( $dir ) . "{$name}.{$ext}";
+        $info = pathinfo( $file );
+        $ext  = strtolower( $info['extension'] );
+        $name = wp_unique_filename( $info['dirname'], uniqid() . "-bp-cover-image.$ext" );
+
+        return trailingslashit( $info['dirname'] ) . $name;
     }
 

trunk/src/bp-members/bp-members-functions.php

@@ -1840 +1840 @@
         $user_login     = preg_replace( '/\s+/', '', sanitize_user( $user_login, true ) );
         $user_email     = sanitize_email( $user_email );
-        $activation_key = substr( md5( time() . rand() . $user_email ), 0, 16 );
+        $activation_key = wp_generate_password( 32, false );
 
         /**
@@ -1862 +1862 @@
             }
 
-            $activation_key = wp_hash( $user_id );
             bp_update_user_meta( $user_id, 'activation_key', $activation_key );
         }
@@ -1990 +1989 @@
         $user_id = username_exists( $signup->user_login );
 
-        // Create the user.
+        // Create the user. This should only be necessary if BP_SIGNUPS_SKIP_USER_CREATION is true.
         if ( ! $user_id ) {
             $user_id = wp_create_user( $signup->user_login, $password, $signup->user_email );
 
-        // If a user ID is found, this may be a legacy signup, or one
-        // created locally for backward compatibility. Process it.
-        } elseif ( $key == wp_hash( $user_id ) ) {
+        // Otherwise, update the existing user's status.
+        } elseif ( $key === bp_get_user_meta( $user_id, 'activation_key', true ) || $key === wp_hash( $user_id ) ) {
+
             // Change the user's status so they become active.
             if ( ! $wpdb->query( $wpdb->prepare( "UPDATE {$wpdb->users} SET user_status = 0 WHERE ID = %d", $user_id ) ) ) {
@@ -2156 +2155 @@
         // Rebuild the activation key, if missing.
         if ( empty( $signup->activation_key ) ) {
-            $signup->activation_key = wp_hash( $signup->ID );
+            $signup->activation_key = wp_generate_password( 32, false );
         }
 

trunk/src/bp-members/bp-members-screens.php

@@ -370 +370 @@
         }
 
-        $hashed_key = wp_hash( $key );
-
-        // Check if the signup avatar folder exists. If it does, move the folder to
-        // the BP user avatars directory.
-        if ( file_exists( bp_core_avatar_upload_path() . '/avatars/signups/' . $hashed_key ) ) {
-            @rename( bp_core_avatar_upload_path() . '/avatars/signups/' . $hashed_key, bp_core_avatar_upload_path() . '/avatars/' . $user );
-        }
-
         bp_core_add_message( __( 'Your account is now active!', 'buddypress' ) );
         $bp->activation_complete = true;

trunk/src/bp-members/classes/class-bp-signup.php

@@ -747 +747 @@
             $user_id = username_exists( $signup->user_login );
 
-            if ( ! empty( $user_id ) && $signup->activation_key == wp_hash( $user_id ) ) {
+            if ( ! empty( $user_id ) && $signup->activation_key === bp_get_user_meta( $user_id, 'activation_key', true ) ) {
 
                 if ( 2 != self::check_user_status( $user_id ) ) {

trunk/src/bp-settings/bp-settings-actions.php

@@ -95 +95 @@
                 // Store a hash to enable email validation.
                 if ( false === $email_error ) {
-                    $hash = wp_hash( $_POST['email'] );
+                    $hash = wp_generate_password( 32, false );
 
                     $pending_email = array(

trunk/tests/phpunit/testcases/members/functions.php

@@ -262 +262 @@
 
         // Fake an old-style registration
-        $key = wp_hash( $u_obj->ID );
+        $key = wp_generate_password( 32, false );
         update_user_meta( $u, 'activation_key', $key );
 
@@ -296 +296 @@
 
         // Fake an old-style registration
-        $key = wp_hash( $u_obj->ID );
+        $key = wp_generate_password( 32, false );
         update_user_meta( $u, 'activation_key', $key );