Changeset 972

Timestamp:

12/06/07 14:02:15 (9 months ago)

Author:

sambauers

Message:

Implement phpass hashing. Mostly lifted from WordPress, so props ryan. Fixes #760

Files:

• trunk/bb-includes/class-phpass.php (added)
• trunk/bb-includes/pluggable.php (modified) (4 diffs)
• trunk/bb-includes/registration-functions.php (modified) (1 diff)
• trunk/profile-edit.php (modified) (1 diff)

trunk/bb-includes/pluggable.php

@@ -4 +4 @@
-function bb_auth() {
-        // Checks if a user is logged in, if not redirects them to the login page
-
-
-
+
+
+
+
+
+
-                nocache_headers();
-
@@ -19 +22 @@
-        global $bbdb;
-        $user = bb_user_sanitize( $user );
+        if ($user == '') {
+                return false;
+        }
+        $user = bb_get_user_by_name( $user );
+        
-        if ( !$already_md5 ) {
-
-
+
+
+
+
+
+
+
+
+
+
+
+
-        } else {
-
-
+
+
+
+
+
+
-}
-endif;
@@ -266 +288 @@
-endif;
-
+if ( !function_exists('wp_hash_password') ) : // [WP6350]
+function wp_hash_password($password) {
+        global $wp_hasher;
+
+        if ( empty($wp_hasher) ) { 
+                require_once( BBPATH . BBINC . 'class-phpass.php');
+                // By default, use the portable hash from phpass
+                $wp_hasher = new PasswordHash(8, TRUE);
+        }
+        
+        return $wp_hasher->HashPassword($password);
+}
+endif;
+
+if ( !function_exists('wp_check_password') ) : // [WP6350]
+function wp_check_password($password, $hash) {
+        global $wp_hasher;
+
+        if ( strlen($hash) <= 32 )
+                return ( $hash == md5($password) );
+
+        // If the stored hash is longer than an MD5, presume the
+        // new style phpass portable hash.
+        if ( empty($wp_hasher) ) {
+                require_once( BBPATH . BBINC . 'class-phpass.php');
+                // By default, use the portable hash from phpass
+                $wp_hasher = new PasswordHash(8, TRUE);
+        }
+
+        return $wp_hasher->CheckPassword($password, $hash);
+}
+endif;
+
-if ( !function_exists('bb_check_admin_referer') ) :
-function bb_check_admin_referer( $action = -1 ) {
@@ -342 +397 @@
-        $now        = bb_current_time('mysql');
-        $password   = bb_random_pass();
-md5
+wp_hash_password
-
-        if ( !$user_login || !$email )

trunk/bb-includes/registration-functions.php

@@ -85 +85 @@
-        $user_id = (int) $user_id;
-
-md5
+wp_hash_password
-
-        $bbdb->query("UPDATE $bbdb->users SET

trunk/profile-edit.php

@@ -103 +103 @@
-                        $_POST['pass1'] = addslashes($_POST['pass1']);
-                        bb_update_user_password( $user->ID, $_POST['pass1'] );
-
-
+
+
+
+
-                endif;
-