Skip to content

Commit 620001f

Browse files
dougalcampbelldougalcampbell
committed
Cookies are now unique, based on siteurl, allowing multiple installs under a single domain name.
git-svn-id: https://develop.svn.wordpress.org/trunk@458 602fd350-edb4-49c9-b593-d223f7449a82
1 parent 5440f4b commit 620001f

11 files changed

Lines changed: 45 additions & 42 deletions

‎b2-include/b2functions.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -380,9 +380,9 @@ function user_pass_ok($user_login,$user_pass) {
380380
}
381381

382382
function get_currentuserinfo() { // a bit like get_userdata(), on steroids
383-
global $HTTP_COOKIE_VARS, $user_login, $userdata, $user_level, $user_ID, $user_nickname, $user_email, $user_url, $user_pass_md5;
383+
global $HTTP_COOKIE_VARS, $user_login, $userdata, $user_level, $user_ID, $user_nickname, $user_email, $user_url, $user_pass_md5, $cookiehash;
384384
// *** retrieving user's data from cookies and db - no spoofing
385-
$user_login = $HTTP_COOKIE_VARS['wordpressuser'];
385+
$user_login = $HTTP_COOKIE_VARS['wordpressuser_'.$cookiehash];
386386
$userdata = get_userdatabylogin($user_login);
387387
$user_level = $userdata->user_level;
388388
$user_ID = $userdata->ID;

‎b2-include/b2template.functions.php‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -598,13 +598,13 @@ function the_content_unicode($more_link_text='(more...)', $stripteaser=0, $more_
598598

599599
function get_the_content($more_link_text='(more...)', $stripteaser=0, $more_file='') {
600600
global $id, $post, $more, $c, $withcomments, $page, $pages, $multipage, $numpages;
601-
global $HTTP_SERVER_VARS, $HTTP_COOKIE_VARS, $preview;
601+
global $HTTP_SERVER_VARS, $HTTP_COOKIE_VARS, $preview, $cookiehash;
602602
global $querystring_start, $querystring_equal, $querystring_separator;
603603
global $pagenow;
604604
$output = '';
605605

606606
if (!empty($post->post_password)) { // if there's a password
607-
if ($HTTP_COOKIE_VARS['wp-postpass'] != $post->post_password) { // and it doesn't match the cookie
607+
if ($HTTP_COOKIE_VARS['wp-postpass_'.$cookiehash] != $post->post_password) { // and it doesn't match the cookie
608608
$output = get_the_password_form();
609609
return $output;
610610
}
@@ -692,11 +692,11 @@ function the_excerpt_unicode() {
692692

693693
function get_the_excerpt($fakeit = false) {
694694
global $id, $post;
695-
global $HTTP_SERVER_VARS, $HTTP_COOKIE_VARS, $preview;
695+
global $HTTP_SERVER_VARS, $HTTP_COOKIE_VARS, $preview, $cookiehash;
696696
$output = '';
697697
$output = stripslashes($post->post_excerpt);
698698
if (!empty($post->post_password)) { // if there's a password
699-
if ($HTTP_COOKIE_VARS['wp-postpass'] != $post->post_password) { // and it doesn't match the cookie
699+
if ($HTTP_COOKIE_VARS['wp-postpass_'.$cookiehash] != $post->post_password) { // and it doesn't match the cookie
700700
$output = "There is no excerpt because this is a protected post.";
701701
return $output;
702702
}
@@ -1173,15 +1173,15 @@ function comments_popup_script($width=400, $height=400, $file='b2commentspopup.p
11731173
}
11741174

11751175
function comments_popup_link($zero='No Comments', $one='1 Comment', $more='% Comments', $CSSclass='', $none='Comments Off') {
1176-
global $id, $b2commentspopupfile, $b2commentsjavascript, $post, $wpdb, $tablecomments, $HTTP_COOKIE_VARS;
1176+
global $id, $b2commentspopupfile, $b2commentsjavascript, $post, $wpdb, $tablecomments, $HTTP_COOKIE_VARS, $cookiehash;
11771177
global $querystring_start, $querystring_equal, $querystring_separator, $siteurl;
11781178
$number = $wpdb->get_var("SELECT COUNT(*) FROM $tablecomments WHERE comment_post_ID = $id");
11791179
if (0 == $number && 'closed' == $post->comment_status) {
11801180
echo $none;
11811181
return;
11821182
} else {
11831183
if (!empty($post->post_password)) { // if there's a password
1184-
if ($HTTP_COOKIE_VARS['wp-postpass'] != $post->post_password) { // and it doesn't match the cookie
1184+
if ($HTTP_COOKIE_VARS['wp-postpass_'.$cookiehash] != $post->post_password) { // and it doesn't match the cookie
11851185
echo("Enter your password to view comments");
11861186
return;
11871187
}

‎b2comments.php‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,15 +4,15 @@
44
if (($withcomments) or ($c)) {
55

66
if (!empty($post->post_password)) { // if there's a password
7-
if ($HTTP_COOKIE_VARS['wp-postpass'] != $post->post_password) { // and it doesn't match the cookie
7+
if ($HTTP_COOKIE_VARS['wp-postpass_'.$cookiehash] != $post->post_password) { // and it doesn't match the cookie
88
echo("<p>Enter your password to view comments.<p>");
99
return;
1010
}
1111
}
1212

13-
$comment_author = trim($HTTP_COOKIE_VARS["comment_author"]);
14-
$comment_author_email = trim($HTTP_COOKIE_VARS["comment_author_email"]);
15-
$comment_author_url = trim($HTTP_COOKIE_VARS["comment_author_url"]);
13+
$comment_author = trim($HTTP_COOKIE_VARS["comment_author_".$cookiehash]);
14+
$comment_author_email = trim($HTTP_COOKIE_VARS["comment_author_email_".$cookiehash]);
15+
$comment_author_url = trim($HTTP_COOKIE_VARS["comment_author_url_".$cookiehash]);
1616

1717
$comments = $wpdb->get_results("SELECT * FROM $tablecomments WHERE comment_post_ID = $id ORDER BY comment_date");
1818
?>

‎b2comments.post.php‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -118,9 +118,9 @@ function add_magic_quotes($array) {
118118
if ($url == '')
119119
$url = ' '; // this to make sure a cookie is set for 'no url'
120120

121-
setcookie('comment_author', $author, time()+30000000);
122-
setcookie('comment_author_email', $email, time()+30000000);
123-
setcookie('comment_author_url', $url, time()+30000000);
121+
setcookie('comment_author_'.$cookiehash, $author, time()+30000000);
122+
setcookie('comment_author_email_'.$cookiehash, $email, time()+30000000);
123+
setcookie('comment_author_url_'.$cookiehash, $url, time()+30000000);
124124

125125
header('Expires: Mon, 26 Jul 1997 05:00:00 GMT');
126126
header('Last-Modified: ' . gmdate('D, d M Y H:i:s') . ' GMT');

‎b2commentspopup.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@
3131
<?php /* this line is b2's motor, do not delete it */
3232
$comments = $wpdb->get_results("SELECT * FROM $tablecomments WHERE comment_post_ID = $id ORDER BY comment_date");
3333
$commentstatus = $wpdb->get_row("SELECT comment_status, post_password FROM $tableposts WHERE ID = $id");
34-
if (!empty($commentstatus->post_password) && $HTTP_COOKIE_VARS['wp-postpass'] != $commentstatus->post_password) { // and it doesn't match the cookie
34+
if (!empty($commentstatus->post_password) && $HTTP_COOKIE_VARS['wp-postpass_'.$cookiehash] != $commentstatus->post_password) { // and it doesn't match the cookie
3535
echo("<li>".get_the_password_form()."</li></ol>");
3636
}
3737
else {

‎b2login.php‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -44,8 +44,8 @@ function add_magic_quotes($array) {
4444

4545
case 'logout':
4646

47-
setcookie('wordpressuser');
48-
setcookie('wordpresspass');
47+
setcookie('wordpressuser_'.$cookiehash);
48+
setcookie('wordpresspass_'.$cookiehash);
4949
header('Expires: Wed, 11 Jan 1984 05:00:00 GMT');
5050
header('Last-Modified: ' . gmdate('D, d M Y H:i:s') . ' GMT');
5151
header('Cache-Control: no-cache, must-revalidate');
@@ -122,14 +122,14 @@ function login() {
122122
} else {
123123
$user_login = $log;
124124
$user_pass = $pwd;
125-
setcookie('wordpressuser', $user_login, time()+31536000);
125+
setcookie('wordpressuser_'.$cookiehash, $user_login, time()+31536000);
126126
if ($pass_is_md5) {
127-
setcookie('wordpresspass', $user_pass, time()+31536000);
127+
setcookie('wordpresspass_'.$cookiehash, $user_pass, time()+31536000);
128128
} else {
129-
setcookie('wordpresspass', md5($user_pass), time()+31536000);
129+
setcookie('wordpresspass_'.$cookiehash, md5($user_pass), time()+31536000);
130130
}
131-
if (empty($HTTP_COOKIE_VARS['wordpressblogid'])) {
132-
setcookie('wordpressblogid', 1,time()+31536000);
131+
if (empty($HTTP_COOKIE_VARS['wordpressblogid_'.$cookiehash])) {
132+
setcookie('wordpressblogid_'.$cookiehash, 1,time()+31536000);
133133
}
134134
header('Expires: Wed, 11 Jan 1984 05:00:00 GMT');
135135
header('Last-Modified: ' . gmdate('D, d M Y H:i:s') . ' GMT');
@@ -231,9 +231,9 @@ function focusit() {
231231

232232
default:
233233

234-
if((!empty($HTTP_COOKIE_VARS['wordpressuser'])) && (!empty($HTTP_COOKIE_VARS['wordpresspass']))) {
235-
$user_login = $HTTP_COOKIE_VARS['wordpressuser'];
236-
$user_pass_md5 = $HTTP_COOKIE_VARS['wordpresspass'];
234+
if((!empty($HTTP_COOKIE_VARS['wordpressuser_'.$cookiehash])) && (!empty($HTTP_COOKIE_VARS['wordpresspass_'.$cookiehash]))) {
235+
$user_login = $HTTP_COOKIE_VARS['wordpressuser_'.$cookiehash];
236+
$user_pass_md5 = $HTTP_COOKIE_VARS['wordpresspass_'.$cookiehash];
237237
}
238238

239239
function checklogin() {
@@ -249,7 +249,7 @@ function checklogin() {
249249
}
250250

251251
if ( !(checklogin()) ) {
252-
if (!empty($HTTP_COOKIE_VARS['wordpressuser'])) {
252+
if (!empty($HTTP_COOKIE_VARS['wordpressuser_'.$cookiehash])) {
253253
$error="Error: wrong login/password"; //, or your session has expired.";
254254
}
255255
} else {

‎wp-admin/b2profile.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,7 @@ function add_magic_quotes($array) {
7979
die ("<strong>ERROR</strong>: you typed two different passwords. Go back to correct that.");
8080
$newuser_pass = $HTTP_POST_VARS["pass1"];
8181
$updatepassword = "user_pass='$newuser_pass', ";
82-
setcookie("wordpresspass",md5($newuser_pass),time()+31536000);
82+
setcookie("wordpresspass_".$cookiehash,md5($newuser_pass),time()+31536000);
8383
}
8484

8585
$newuser_firstname=addslashes($HTTP_POST_VARS["newuser_firstname"]);
@@ -115,7 +115,7 @@ function add_magic_quotes($array) {
115115
require_once('b2verifauth.php');
116116

117117
$profiledata = get_userdata($user);
118-
if ($HTTP_COOKIE_VARS['wordpressuser'] == $profiledata->user_login)
118+
if ($HTTP_COOKIE_VARS['wordpressuser_'.$cookiehash] == $profiledata->user_login)
119119
header ('Location: b2profile.php');
120120

121121
$profile = 1;

‎wp-admin/b2verifauth.php‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,12 @@
44

55
/* checking login & pass in the database */
66
function veriflog() {
7-
global $HTTP_COOKIE_VARS;
7+
global $HTTP_COOKIE_VARS,$cookiehash;
88
global $tableusers, $wpdb;
99

10-
if (!empty($HTTP_COOKIE_VARS["wordpressuser"])) {
11-
$user_login = $HTTP_COOKIE_VARS["wordpressuser"];
12-
$user_pass_md5 = $HTTP_COOKIE_VARS["wordpresspass"];
10+
if (!empty($HTTP_COOKIE_VARS["wordpressuser_".$cookiehash])) {
11+
$user_login = $HTTP_COOKIE_VARS["wordpressuser_".$cookiehash];
12+
$user_pass_md5 = $HTTP_COOKIE_VARS["wordpresspass_".$cookiehash];
1313
} else {
1414
return false;
1515
}
@@ -38,7 +38,7 @@ function veriflog() {
3838
header('Last-Modified: ' . gmdate('D, d M Y H:i:s') . ' GMT');
3939
header('Cache-Control: no-cache, must-revalidate');
4040
header('Pragma: no-cache');
41-
if (!empty($HTTP_COOKIE_VARS["wordpressuser"])) {
41+
if (!empty($HTTP_COOKIE_VARS["wordpressuser_".$cookiehash])) {
4242
$error="<strong>Error</strong>: wrong login or password";
4343
}
4444
header("Location: $siteurl/b2login.php");

‎wp-admin/linkmanager.php‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -84,8 +84,8 @@ function add_magic_quotes($array) {
8484
}
8585
}
8686

87-
$links_show_cat_id = $HTTP_COOKIE_VARS["links_show_cat_id"];
88-
$links_show_order = $HTTP_COOKIE_VARS["links_show_order"];
87+
$links_show_cat_id = $HTTP_COOKIE_VARS["links_show_cat_id_".$cookiehash];
88+
$links_show_order = $HTTP_COOKIE_VARS["links_show_order_".$cookiehash];
8989

9090
if ($action2 != '')
9191
$action = $action2;
@@ -263,7 +263,7 @@ function add_magic_quotes($array) {
263263
" link_notes='" . addslashes($link_notes) . "'\n" .
264264
" WHERE link_id=$link_id");
265265
} // end if save
266-
setcookie('links_show_cat_id', $links_show_cat_id, time()+600);
266+
setcookie('links_show_cat_id_'.$cookiehash, $links_show_cat_id, time()+600);
267267
header('Location: '.$this_file);
268268
break;
269269
} // end Save
@@ -288,7 +288,7 @@ function add_magic_quotes($array) {
288288
$cat_id = 'All';
289289
}
290290
$links_show_cat_id = $cat_id;
291-
setcookie("links_show_cat_id", $links_show_cat_id, time()+600);
291+
setcookie("links_show_cat_id_".$cookiehash, $links_show_cat_id, time()+600);
292292
header('Location: '.$this_file);
293293
break;
294294
} // end Delete
@@ -441,8 +441,8 @@ function add_magic_quotes($array) {
441441
$order_by = 'order_name';
442442
$links_show_order = $order_by;
443443

444-
setcookie('links_show_cat_id', $links_show_cat_id, time()+600);
445-
setcookie('links_show_order', $links_show_order, time()+600);
444+
setcookie('links_show_cat_id_'.$cookiehash, $links_show_cat_id, time()+600);
445+
setcookie('links_show_order_'.$cookiehash, $links_show_order, time()+600);
446446
$standalone=0;
447447
include_once ("./b2header.php");
448448
if ($user_level < get_settings('links_minadminlevel')) {

‎wp-pass.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,8 @@
55
It doesn't need to connect to the DB, or do anything fancy at all. Yum.
66
-- Matt
77
*/
8-
9-
setcookie('wp-postpass', $HTTP_POST_VARS['post_password'], time()+60*60*24*30);
8+
include_once('wp-config.php');
9+
setcookie('wp-postpass_'.$cookiehash, $HTTP_POST_VARS['post_password'], time()+60*60*24*30);
1010
header('Location: ' . $HTTP_SERVER_VARS['HTTP_REFERER']);
1111

1212
?>

0 commit comments

Comments
 (0)