Harden HMAC verification. props duck_.

nacin · nacin · commit 3234ade164d6 · 2014-04-08T18:05:42.000Z
git-svn-id: https://develop.svn.wordpress.org/trunk@28053 602fd350-edb4-49c9-b593-d223f7449a82
diff --git a/src/wp-includes/pluggable.php b/src/wp-includes/pluggable.php
@@ -647,7 +647,7 @@ function wp_validate_auth_cookie($cookie = '', $scheme = '') {
 	$key = wp_hash($username . $pass_frag . '|' . $expiration, $scheme);
 	$hash = hash_hmac('md5', $username . '|' . $expiration, $key);
 
-	if ( $hmac != $hash ) {
+	if ( hash_hmac( 'md5', $hmac, $key ) !== hash_hmac( 'md5', $hash, $key ) ) {
 		/**
 		 * Fires if a bad authentication cookie hash is encountered.
 		 *

Original file line number	Diff line number	Diff line change
`@@ -647,7 +647,7 @@ function wp_validate_auth_cookie($cookie = '', $scheme = '') {`
`647`	`647`	`$key = wp_hash($username . $pass_frag . '\|' . $expiration, $scheme);`
`648`	`648`	`$hash = hash_hmac('md5', $username . '\|' . $expiration, $key);`
`649`	`649`
`650`		`- if ( $hmac != $hash ) {`
	`650`	`+ if ( hash_hmac( 'md5', $hmac, $key ) !== hash_hmac( 'md5', $hash, $key ) ) {`
`651`	`651`	`/**`
`652`	`652`	`* Fires if a bad authentication cookie hash is encountered.`
`653`	`653`	`*`