sergiotarxz
/
Wordpress
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Prevent high resource usage when hashing large passwords. props mdawaffe, pento 

git-svn-id: https://develop.svn.wordpress.org/trunk@30466 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Andrew Nacin 2014-11-20 16:02:55 +00:00
parent e1d16e8080
commit aec2f2654e
2 changed files with 54 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/wp-includes/class-phpass.php
View File

@ -214,6 +214,10 @@ class PasswordHash {
function HashPassword($password)
{
if ( strlen( $password ) > 4096 ) {
return '*';
}
$random = '';
if (CRYPT_BLOWFISH == 1 && !$this->portable_hashes) {
@ -249,6 +253,10 @@ class PasswordHash {
function CheckPassword($password, $stored_hash)
{
if ( strlen( $password ) > 4096 ) {
return false;
}
$hash = $this->crypt_private($password, $stored_hash);
if ($hash[0] == '*')
$hash = crypt($password, $stored_hash);

46
tests/phpunit/tests/auth.php
View File

@ -2,6 +2,7 @@
/**
* @group pluggable
* @group auth
*/
class Tests_Auth extends WP_UnitTestCase {
var $user_id;
@ -99,4 +100,49 @@ class Tests_Auth extends WP_UnitTestCase {
$this->assertFalse( wp_verify_nonce( '' ) );
$this->assertFalse( wp_verify_nonce( null ) );
}
function test_password_length_limit() {
$passwords = array(
str_repeat( 'a', 4095 ), // short
str_repeat( 'a', 4096 ), // limit
str_repeat( 'a', 4097 ), // long
);
$user_id = $this->factory->user->create( array( 'user_login' => 'password-length-test' ) );
wp_set_password( $passwords[1], $user_id );
$user = get_user_by( 'id', $user_id );
// phpass hashed password
$this->assertStringStartsWith( '$P$', $user->data->user_pass );
$user = wp_authenticate( 'password-length-test', $passwords[0] );
// Wrong Password
$this->assertInstanceOf( 'WP_Error', $user );
$user = wp_authenticate( 'password-length-test', $passwords[1] );
$this->assertInstanceOf( 'WP_User', $user );
$this->assertEquals( $user_id, $user->ID );
$user = wp_authenticate( 'password-length-test', $passwords[2] );
// Wrong Password
$this->assertInstanceOf( 'WP_Error', $user );
wp_set_password( $passwords[2], $user_id );
$user = get_user_by( 'id', $user_id );
// Password broken by setting it to be too long.
$this->assertEquals( '*', $user->data->user_pass );
$user = wp_authenticate( 'password-length-test', $passwords[0] );
// Wrong Password
$this->assertInstanceOf( 'WP_Error', $user );
$user = wp_authenticate( 'password-length-test', $passwords[1] );
// Wrong Password
$this->assertInstanceOf( 'WP_Error', $user );
$user = wp_authenticate( 'password-length-test', $passwords[2] );
// Password broken by setting it to be too long.
$this->assertInstanceOf( 'WP_Error', $user );
}
}