Changeset 10800 for trunk/src/bp-members/bp-members-functions.php

Timestamp:

05/24/2016 02:34:37 PM (9 years ago)

Author:

boonebgorges

Message:

Better hash building for activation keys, password reset keys, and filenames.

There is no need to use user-facing info for these hashes.

Props DJPaul, vortfu.

File:

• trunk/src/bp-members/bp-members-functions.php (modified) (4 diffs)

trunk/src/bp-members/bp-members-functions.php

@@ -1840 +1840 @@
         $user_login     = preg_replace( '/\s+/', '', sanitize_user( $user_login, true ) );
         $user_email     = sanitize_email( $user_email );
-        $activation_key = substr( md5( time() . rand() . $user_email ), 0, 16 );
+        $activation_key = wp_generate_password( 32, false );
 
         /**
@@ -1862 +1862 @@
             }
 
-            $activation_key = wp_hash( $user_id );
             bp_update_user_meta( $user_id, 'activation_key', $activation_key );
         }
@@ -1990 +1989 @@
         $user_id = username_exists( $signup->user_login );
 
-        // Create the user.
+        // Create the user. This should only be necessary if BP_SIGNUPS_SKIP_USER_CREATION is true.
         if ( ! $user_id ) {
             $user_id = wp_create_user( $signup->user_login, $password, $signup->user_email );
 
-        // If a user ID is found, this may be a legacy signup, or one
-        // created locally for backward compatibility. Process it.
-        } elseif ( $key == wp_hash( $user_id ) ) {
+        // Otherwise, update the existing user's status.
+        } elseif ( $key === bp_get_user_meta( $user_id, 'activation_key', true ) || $key === wp_hash( $user_id ) ) {
+
             // Change the user's status so they become active.
             if ( ! $wpdb->query( $wpdb->prepare( "UPDATE {$wpdb->users} SET user_status = 0 WHERE ID = %d", $user_id ) ) ) {
@@ -2156 +2155 @@
         // Rebuild the activation key, if missing.
         if ( empty( $signup->activation_key ) ) {
-            $signup->activation_key = wp_hash( $signup->ID );
+            $signup->activation_key = wp_generate_password( 32, false );
         }