| @@ -16,8 +16,15 @@ | ||
| 16 | 16 | */ |
| 17 | 17 | class AEF extends BBP_Converter_Base { |
| 18 | 18 | |
| 19 | 19 | /** |
| 20 | + * Main Constructor | |
| 21 | + */ | |
| 22 | + public function __construct() { | |
| 23 | + parent::__construct(); | |
| 24 | + } | |
| 25 | + | |
| 26 | + /** | |
| 20 | 27 | * Sets up the field mappings |
| 21 | 28 | */ |
| 22 | 29 | public function setup_globals() { |
| 23 | 30 | |
| @@ -124,24 +131,24 @@ | ||
| 124 | 131 | // Forum dates. |
| 125 | 132 | $this->field_map[] = array( |
| 126 | 133 | 'to_type' => 'forum', |
| 127 | 134 | 'to_fieldname' => 'post_date', |
| 128 | - 'default' => date( 'Y-m-d H:i:s' ) // phpcs:ignore | |
| 135 | + 'default' => date( 'Y-m-d H:i:s' ) // phpcs:ignore WordPress.DateTime.RestrictedFunctions.date_date | |
| 129 | 136 | ); |
| 130 | 137 | $this->field_map[] = array( |
| 131 | 138 | 'to_type' => 'forum', |
| 132 | 139 | 'to_fieldname' => 'post_date_gmt', |
| 133 | - 'default' => gmdate( 'Y-m-d H:i:s' ) | |
| 140 | + 'default' => date( 'Y-m-d H:i:s' ) // phpcs:ignore WordPress.DateTime.RestrictedFunctions.date_date | |
| 134 | 141 | ); |
| 135 | 142 | $this->field_map[] = array( |
| 136 | 143 | 'to_type' => 'forum', |
| 137 | 144 | 'to_fieldname' => 'post_modified', |
| 138 | - 'default' => date( 'Y-m-d H:i:s' ) // phpcs:ignore | |
| 145 | + 'default' => date( 'Y-m-d H:i:s' ) // phpcs:ignore WordPress.DateTime.RestrictedFunctions.date_date | |
| 139 | 146 | ); |
| 140 | 147 | $this->field_map[] = array( |
| 141 | 148 | 'to_type' => 'forum', |
| 142 | 149 | 'to_fieldname' => 'post_modified_gmt', |
| 143 | - 'default' => gmdate( 'Y-m-d H:i:s' ) | |
| 150 | + 'default' => date( 'Y-m-d H:i:s' ) // phpcs:ignore WordPress.DateTime.RestrictedFunctions.date_date | |
| 144 | 151 | ); |
| 145 | 152 | |
| 146 | 153 | /** Topic Section *****************************************************/ |
| 147 | 154 | |
| @@ -442,9 +449,9 @@ | ||
| 442 | 449 | ); |
| 443 | 450 | |
| 444 | 451 | // User password verify class (Stored in usermeta for verifying password) |
| 445 | 452 | $this->field_map[] = array( |
| 446 | - 'to_type' => 'user', | |
| 453 | + 'to_type' => 'users', | |
| 447 | 454 | 'to_fieldname' => '_bbp_class', |
| 448 | 455 | 'default' => 'AEF' |
| 449 | 456 | ); |
| 450 | 457 | |
| @@ -570,9 +577,9 @@ | ||
| 570 | 577 | */ |
| 571 | 578 | public function callback_savepass( $field, $row ) { |
| 572 | 579 | $pass_array = array( |
| 573 | 580 | 'hash' => $field, |
| 574 | - 'salt' => isset( $row['salt'] ) ? wp_slash( (string) $row['salt'] ) : '' | |
| 581 | + 'salt' => $row['salt'] | |
| 575 | 582 | ); |
| 576 | 583 | |
| 577 | 584 | return $pass_array; |
| 578 | 585 | } |
| @@ -583,30 +590,26 @@ | ||
| 583 | 590 | */ |
| 584 | 591 | public function authenticate_pass( $password, $serialized_pass ) { |
| 585 | 592 | |
| 586 | 593 | // Unserialize the password, with safeguards |
| 587 | - $pass_array = $this->unserialize_pass( $serialized_pass ); | |
| 594 | + $pass_array = unserialize( | |
| 595 | + $serialized_pass, | |
| 596 | + array( | |
| 597 | + 'allowed_classes' => false, | |
| 598 | + 'max_depth' => 1 | |
| 599 | + ) | |
| 600 | + ); | |
| 588 | 601 | |
| 589 | - // Bail if missing or invalid values | |
| 590 | - if ( ! is_string( $password ) || ! is_array( $pass_array ) || ! isset( $pass_array['hash'], $pass_array['salt'] ) || ! is_string( $pass_array['hash'] ) || ! is_string( $pass_array['salt'] ) ) { | |
| 602 | + // Bail if missing values | |
| 603 | + if ( ! is_array( $pass_array ) || ! isset( $pass_array['hash'], $pass_array['salt'] ) ) { | |
| 591 | 604 | return false; |
| 592 | 605 | } |
| 593 | 606 | |
| 594 | - // AEF encodes and escapes the submitted password before hashing it | |
| 595 | - foreach ( array( 'UTF-8', 'ISO-8859-1' ) as $charset ) { | |
| 596 | - $legacy_password = addslashes( htmlentities( $password, ENT_QUOTES, $charset ) ); | |
| 597 | - | |
| 598 | - // Do not let invalid input collapse to an empty password | |
| 599 | - if ( ( '' === $legacy_password ) && ( '' !== $password ) ) { | |
| 600 | - continue; | |
| 601 | - } | |
| 602 | - | |
| 603 | - if ( hash_equals( $pass_array['hash'], md5( $pass_array['salt'] . $legacy_password ) ) ) { | |
| 604 | - return true; | |
| 605 | - } | |
| 606 | - } | |
| 607 | - | |
| 608 | - return false; | |
| 607 | + // Return comparison | |
| 608 | + return hash_equals( | |
| 609 | + $pass_array['hash'], | |
| 610 | + md5( md5( $password ) . $pass_array['salt'] ) | |
| 611 | + ); | |
| 609 | 612 | } |
| 610 | 613 | |
| 611 | 614 | /** |
| 612 | 615 | * Translate the forum status from AEF v1.0.9 numerics to WordPress's strings. |
