WordPress.org
Get WordPress

Plugin Directory

Changeset 830429


Ignore:
Timestamp:
12/30/2013 08:25:21 PM (12 years ago)
Author:
Henrik.Schack
Message:

App password hash function switched to one that doesn't have rainbow tables available

File:
1 edited

Legend:

Unmodified
Added
Removed

  • google-authenticator/trunk/google-authenticator.php

    r830388 r830429  
    2222    Thanks to Ian Dunn for fixing some depricated function calls.
    2323    Thanks to Kimmo Suominen for fixing the iPhone description issue.
     24    Thanks to Alex Concha for some security tips.
    2425
    2526----------------------------------------------------------------------------
    … …  
    192193            if ( trim( get_user_option( 'googleauthenticator_pwdenabled', $user->ID ) ) == 'enabled' && ( defined('XMLRPC_REQUEST') || defined('APP_REQUEST') ) ) {
    193194                $GA_passwords   = json_decode(  get_user_option( 'googleauthenticator_passwords', $user->ID ) );
    194                 $passwordsha1   = trim($GA_passwords->{'password'} );
     195                $passwordhash   = trim($GA_passwords->{'password'} );
    195196                $usersha1       = sha1( strtoupper( str_replace( ' ', '', $password ) ) );
    196                 if ( $passwordsha1 == $usersha1 ) {
     197                if ( $passwordhash == $usersha1 ) { // ToDo: Remove after some time when users have migrated to new format
     198                    return new WP_User( $user->ID );
     199                  // Try the new version based on thee wp_hash_password function
     200                } elseif (wp_check_password( strtoupper( str_replace( ' ', '', $password ) ), $passwordhash)) {
    197201                    return new WP_User( $user->ID );
    198202                } else {
    … …  
    406410    if (strtoupper($GA_password) != 'XXXXXXXXXXXXXXXX' ) {
    407411        // Store the password in a format that can be expanded easily later on if needed.
    408         $GA_password = array( 'appname' => 'Default', 'password' => sha1( $GA_password ) );
     412        $GA_password = array( 'appname' => 'Default', 'password' => wp_hash_password( $GA_password ) );
    409413        update_user_option( $user_id, 'googleauthenticator_passwords', json_encode( $GA_password ), true );
    410414    }
Note: See TracChangeset for help on using the changeset viewer.