Changeset 10801 for branches/2.5/src/bp-members/bp-members-functions.php

Timestamp:

05/24/2016 02:45:08 PM (10 years ago)

Author:

boonebgorges

Message:

Better hash building for activation keys, password reset keys, and filenames.

There is no need to use user-facing info for these hashes.

Ports [10800] to the 2.5 branch.

Props DJPaul, vortfu.

Location:

branches/2.5

Files:

• . (modified) (1 prop)
• src/bp-members/bp-members-functions.php (modified) (4 diffs)

branches/2.5/src/bp-members/bp-members-functions.php

@@ -1792 +1792 @@
                 $user_login     = preg_replace( '/\s+/', '', sanitize_user( $user_login, true ) );
                 $user_email     = sanitize_email( $user_email );
-                $activation_key = substr( md5( time() . rand() . $user_email ), 0, 16 );
+                $activation_key = wp_generate_password( 32, false );
 
                 /**
@@ -1814 +1814 @@
                         }
 
-                        $activation_key = wp_hash( $user_id );
                         bp_update_user_meta( $user_id, 'activation_key', $activation_key );
                 }
@@ -1938 +1937 @@
                 $user_id = username_exists( $signup->user_login );
 
-                // Create the user.
+                // Create the user. This should only be necessary if BP_SIGNUPS_SKIP_USER_CREATION is true.
                 if ( ! $user_id ) {
                         $user_id = wp_create_user( $signup->user_login, $password, $signup->user_email );
 
-                // If a user ID is found, this may be a legacy signup, or one
-                // created locally for backward compatibility. Process it.
-                } elseif ( $key == wp_hash( $user_id ) ) {
+                // Otherwise, update the existing user's status.
+                } elseif ( $key === bp_get_user_meta( $user_id, 'activation_key', true ) || $key === wp_hash( $user_id ) ) {
+
                         // Change the user's status so they become active.
                         if ( ! $wpdb->query( $wpdb->prepare( "UPDATE {$wpdb->users} SET user_status = 0 WHERE ID = %d", $user_id ) ) ) {
@@ -2104 +2103 @@
                 // Rebuild the activation key, if missing.
                 if ( empty( $signup->activation_key ) ) {
-                        $signup->activation_key = wp_hash( $signup->ID );
+                        $signup->activation_key = wp_generate_password( 32, false );
                 }