vhad/wordpress-develop
1
0
Fork 0
mirror of https://github.com/gosticks/wordpress-develop.git synced 2026-04-01 11:14:36 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Prevent high resource usage when hashing large passwords. props mdawaffe, pento

Browse Source 
git-svn-id: https://develop.svn.wordpress.org/trunk@30466 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Andrew Nacin
2014-11-20 16:02:55 +00:00
parent e1d16e8080
commit aec2f2654e
2 changed files with 54 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

46
tests/phpunit/tests/auth.php
View File

@@ -2,6 +2,7 @@
/**
* @group pluggable
* @group auth
*/
class Tests_Auth extends WP_UnitTestCase {
var $user_id;
@@ -99,4 +100,49 @@ class Tests_Auth extends WP_UnitTestCase {
$this->assertFalse( wp_verify_nonce( '' ) );
$this->assertFalse( wp_verify_nonce( null ) );
}
function test_password_length_limit() {
$passwords = array(
str_repeat( 'a', 4095 ), // short
str_repeat( 'a', 4096 ), // limit
str_repeat( 'a', 4097 ), // long
);
$user_id = $this->factory->user->create( array( 'user_login' => 'password-length-test' ) );
wp_set_password( $passwords[1], $user_id );
$user = get_user_by( 'id', $user_id );
// phpass hashed password
$this->assertStringStartsWith( '$P$', $user->data->user_pass );
$user = wp_authenticate( 'password-length-test', $passwords[0] );
// Wrong Password
$this->assertInstanceOf( 'WP_Error', $user );
$user = wp_authenticate( 'password-length-test', $passwords[1] );
$this->assertInstanceOf( 'WP_User', $user );
$this->assertEquals( $user_id, $user->ID );
$user = wp_authenticate( 'password-length-test', $passwords[2] );
// Wrong Password
$this->assertInstanceOf( 'WP_Error', $user );
wp_set_password( $passwords[2], $user_id );
$user = get_user_by( 'id', $user_id );
// Password broken by setting it to be too long.
$this->assertEquals( '*', $user->data->user_pass );
$user = wp_authenticate( 'password-length-test', $passwords[0] );
// Wrong Password
$this->assertInstanceOf( 'WP_Error', $user );
$user = wp_authenticate( 'password-length-test', $passwords[1] );
// Wrong Password
$this->assertInstanceOf( 'WP_Error', $user );
$user = wp_authenticate( 'password-length-test', $passwords[2] );
// Password broken by setting it to be too long.
$this->assertInstanceOf( 'WP_Error', $user );
}
}