From 09fd082625aefbf3785f2eb7dfd1460f289716dd Mon Sep 17 00:00:00 2001
From: Peter Wilson <peterwilsoncc@git.wordpress.org>
Date: Tue, 4 Oct 2022 03:57:29 +0000
Subject: [PATCH] Security: Additional translations of salt default phrase.

Translate the default salt value "put your unique phrase here" in additional locations in which it is used. This further ensures that the default phrase is considered an error in non-english translations of `wp-config.php`.

Follow-up to [54249].

Props peterwilsoncc, audrasjb, JeffPaul.
Fixes #55937.



git-svn-id: https://develop.svn.wordpress.org/trunk@54379 602fd350-edb4-49c9-b593-d223f7449a82
---
 src/wp-admin/maint/repair.php                 | 20 +++++++++++++++----
 .../class-wp-recovery-mode-cookie-service.php | 16 +++++++++++++--
 2 files changed, 30 insertions(+), 6 deletions(-)

diff --git a/src/wp-admin/maint/repair.php b/src/wp-admin/maint/repair.php
index 6c9e8fe82a..2399f766be 100644
--- a/src/wp-admin/maint/repair.php
+++ b/src/wp-admin/maint/repair.php
@@ -37,7 +37,17 @@ if ( ! defined( 'WP_ALLOW_REPAIR' ) || ! WP_ALLOW_REPAIR ) {
 	);
 	echo "</p><p><code>define('WP_ALLOW_REPAIR', true);</code></p>";
 
-	$default_key     = __( 'put your unique phrase here' );
+	$default_keys    = array_unique(
+		array(
+			'put your unique phrase here',
+			/*
+			 * translators: This string should only be translated if wp-config-sample.php is localized.
+			 * You can check the localized release package or
+			 * https://i18n.svn.wordpress.org/<locale code>/branches/<wp version>/dist/wp-config-sample.php
+			 */
+			__( 'put your unique phrase here' ),
+		)
+	);
 	$missing_key     = false;
 	$duplicated_keys = array();
 
@@ -51,9 +61,11 @@ if ( ! defined( 'WP_ALLOW_REPAIR' ) || ! WP_ALLOW_REPAIR ) {
 		}
 	}
 
-	// If at least one key uses the default value, consider it duplicated.
-	if ( isset( $duplicated_keys[ $default_key ] ) ) {
-		$duplicated_keys[ $default_key ] = true;
+	// If at least one key uses a default value, consider it duplicated.
+	foreach ( $default_keys as $default_key ) {
+		if ( isset( $duplicated_keys[ $default_key ] ) ) {
+			$duplicated_keys[ $default_key ] = true;
+		}
 	}
 
 	// Weed out all unique, non-default values.
diff --git a/src/wp-includes/class-wp-recovery-mode-cookie-service.php b/src/wp-includes/class-wp-recovery-mode-cookie-service.php
index 5d3be11f6e..a2ee34a723 100644
--- a/src/wp-includes/class-wp-recovery-mode-cookie-service.php
+++ b/src/wp-includes/class-wp-recovery-mode-cookie-service.php
@@ -198,7 +198,19 @@ final class WP_Recovery_Mode_Cookie_Service {
 	 * @return string|false The hashed $data, or false on failure.
 	 */
 	private function recovery_mode_hash( $data ) {
-		if ( ! defined( 'AUTH_KEY' ) || AUTH_KEY === __( 'put your unique phrase here' ) ) {
+		$default_keys = array_unique(
+			array(
+				'put your unique phrase here',
+				/*
+				 * translators: This string should only be translated if wp-config-sample.php is localized.
+				 * You can check the localized release package or
+				 * https://i18n.svn.wordpress.org/<locale code>/branches/<wp version>/dist/wp-config-sample.php
+				 */
+				__( 'put your unique phrase here' ),
+			)
+		);
+
+		if ( ! defined( 'AUTH_KEY' ) || in_array( AUTH_KEY, $default_keys, true ) ) {
 			$auth_key = get_site_option( 'recovery_mode_auth_key' );
 
 			if ( ! $auth_key ) {
@@ -213,7 +225,7 @@ final class WP_Recovery_Mode_Cookie_Service {
 			$auth_key = AUTH_KEY;
 		}
 
-		if ( ! defined( 'AUTH_SALT' ) || AUTH_SALT === 'put your unique phrase here' || AUTH_SALT === $auth_key ) {
+		if ( ! defined( 'AUTH_SALT' ) || in_array( AUTH_SALT, $default_keys, true ) || AUTH_SALT === $auth_key ) {
 			$auth_salt = get_site_option( 'recovery_mode_auth_salt' );
 
 			if ( ! $auth_salt ) {