Changeset 10801 for branches/2.5/src/bp-core/classes/class-bp-attachment-avatar.php

Timestamp:

05/24/2016 02:45:08 PM (10 years ago)

Author:

boonebgorges

Message:

Better hash building for activation keys, password reset keys, and filenames.

There is no need to use user-facing info for these hashes.

Ports [10800] to the 2.5 branch.

Props DJPaul, vortfu.

Location:

branches/2.5

Files:

• . (modified) (1 prop)
• src/bp-core/classes/class-bp-attachment-avatar.php (modified) (1 diff)

branches/2.5/src/bp-core/classes/class-bp-attachment-avatar.php

@@ -293 +293 @@
                         }
 
-                        $args['dst_file'] = $avatar_folder_dir . '/' . wp_hash( $absolute_path . time() ) . '-bp' . $key_type . '.' . $ext;
+                        $filename         = wp_unique_filename( $avatar_folder_dir, uniqid() . "-bp{$key_type}.{$ext}" );
+                        $args['dst_file'] = $avatar_folder_dir . '/' . $filename;
 
                         $avatar_types[ $key_type ] = parent::crop( $args );