Changeset 10801 for branches/2.5/src/bp-members/classes/class-bp-signup.php

Timestamp:

05/24/2016 02:45:08 PM (10 years ago)

Author:

boonebgorges

Message:

Better hash building for activation keys, password reset keys, and filenames.

There is no need to use user-facing info for these hashes.

Ports [10800] to the 2.5 branch.

Props DJPaul, vortfu.

Location:

branches/2.5

Files:

• . (modified) (1 prop)
• src/bp-members/classes/class-bp-signup.php (modified) (1 diff)

branches/2.5/src/bp-members/classes/class-bp-signup.php

@@ -737 +737 @@
                         $user_id = username_exists( $signup->user_login );
 
-                        if ( ! empty( $user_id ) && $signup->activation_key == wp_hash( $user_id ) ) {
+                        if ( ! empty( $user_id ) && $signup->activation_key === bp_get_user_meta( $user_id, 'activation_key', true ) ) {
 
                                 if ( 2 != self::check_user_status( $user_id ) ) {