vhad/wordpress-develop
1
0
Fork 0
mirror of https://github.com/gosticks/wordpress-develop.git synced 2026-08-12 12:50:28 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Users: when passing a WP_User instance to wp_update_user(), ensure that the user password is not accidentally double-hashed. This is terrifying.

Browse Source 
Adds unit tests.

Props tbcorr, salcode.
Fixes #28435.


git-svn-id: https://develop.svn.wordpress.org/trunk@35116 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Scott Taylor
2015-10-13 02:47:09 +00:00
parent 4a2184d00c
commit 34cb01e2f1
2 changed files with 15 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/wp-includes/user-functions.php
+1 -1
View File
@@ -1602,7 +1602,7 @@ function wp_update_user($userdata) {
// Escape data pulled from DB.
$user = add_magic_quotes( $user );
if ( ! empty($userdata['user_pass']) ) {
if ( ! empty( $userdata['user_pass'] ) && $userdata['user_pass'] !== $user_obj->user_pass ) {
// If password is changing, hash it now
$plaintext_pass = $userdata['user_pass'];
$userdata['user_pass'] = wp_hash_password( $userdata['user_pass'] );