| @@ -16,8 +16,16 @@ | ||
| 16 | 16 | */ |
| 17 | 17 | class PHPFox3 extends BBP_Converter_Base { |
| 18 | 18 | |
| 19 | 19 | /** |
| 20 | + * Main Constructor | |
| 21 | + * | |
| 22 | + */ | |
| 23 | + public function __construct() { | |
| 24 | + parent::__construct(); | |
| 25 | + } | |
| 26 | + | |
| 27 | + /** | |
| 20 | 28 | * Sets up the field mappings |
| 21 | 29 | */ |
| 22 | 30 | public function setup_globals() { |
| 23 | 31 | |
| @@ -126,24 +134,24 @@ | ||
| 126 | 134 | // Forum dates. |
| 127 | 135 | $this->field_map[] = array( |
| 128 | 136 | 'to_type' => 'forum', |
| 129 | 137 | 'to_fieldname' => 'post_date', |
| 130 | - 'default' => date( 'Y-m-d H:i:s' ) // phpcs:ignore | |
| 138 | + 'default' => date( 'Y-m-d H:i:s' ) // phpcs:ignore WordPress.DateTime.RestrictedFunctions.date_date | |
| 131 | 139 | ); |
| 132 | 140 | $this->field_map[] = array( |
| 133 | 141 | 'to_type' => 'forum', |
| 134 | 142 | 'to_fieldname' => 'post_date_gmt', |
| 135 | - 'default' => gmdate( 'Y-m-d H:i:s' ) | |
| 143 | + 'default' => date( 'Y-m-d H:i:s' ) // phpcs:ignore WordPress.DateTime.RestrictedFunctions.date_date | |
| 136 | 144 | ); |
| 137 | 145 | $this->field_map[] = array( |
| 138 | 146 | 'to_type' => 'forum', |
| 139 | 147 | 'to_fieldname' => 'post_modified', |
| 140 | - 'default' => date( 'Y-m-d H:i:s' ) // phpcs:ignore | |
| 148 | + 'default' => date( 'Y-m-d H:i:s' ) // phpcs:ignore WordPress.DateTime.RestrictedFunctions.date_date | |
| 141 | 149 | ); |
| 142 | 150 | $this->field_map[] = array( |
| 143 | 151 | 'to_type' => 'forum', |
| 144 | 152 | 'to_fieldname' => 'post_modified_gmt', |
| 145 | - 'default' => gmdate( 'Y-m-d H:i:s' ) | |
| 153 | + 'default' => date( 'Y-m-d H:i:s' ) // phpcs:ignore WordPress.DateTime.RestrictedFunctions.date_date | |
| 146 | 154 | ); |
| 147 | 155 | |
| 148 | 156 | /** Topic Section *****************************************************/ |
| 149 | 157 | |
| @@ -506,9 +514,9 @@ | ||
| 506 | 514 | */ |
| 507 | 515 | public function callback_savepass( $field, $row ) { |
| 508 | 516 | $pass_array = array( |
| 509 | 517 | 'hash' => $field, |
| 510 | - 'salt' => isset( $row['password_salt'] ) ? wp_slash( (string) $row['password_salt'] ) : '' | |
| 518 | + 'salt' => $row['salt'] | |
| 511 | 519 | ); |
| 512 | 520 | |
| 513 | 521 | return $pass_array; |
| 514 | 522 | } |
| @@ -513,43 +521,8 @@ | ||
| 513 | 521 | return $pass_array; |
| 514 | 522 | } |
| 515 | 523 | |
| 516 | 524 | /** |
| 517 | - * Upgrade a phpFox password, recovering salts omitted by older imports. | |
| 518 | - * | |
| 519 | - * @param string $username WordPress user login. | |
| 520 | - * @param string $password Submitted password. | |
| 521 | - * @param string|null $wp_password Optional slashed password for WordPress. | |
| 522 | - */ | |
| 523 | - public function callback_pass( $username = '', $password = '', $wp_password = null ) { | |
| 524 | - $user = get_user_by( 'login', $username ); | |
| 525 | - | |
| 526 | - if ( ! empty( $user ) && '' === $user->user_pass ) { | |
| 527 | - $pass_array = get_user_meta( $user->ID, '_bbp_password', true ); | |
| 528 | - | |
| 529 | - if ( is_array( $pass_array ) && isset( $pass_array['hash'] ) && is_string( $pass_array['hash'] ) && ( ! isset( $pass_array['salt'] ) || ! is_string( $pass_array['salt'] ) || '' === $pass_array['salt'] ) ) { | |
| 530 | - $old_user_id = get_user_meta( $user->ID, '_bbp_old_user_id', true ); | |
| 531 | - | |
| 532 | - if ( ! empty( $old_user_id ) && ! empty( $this->opdb ) && $this->opdb->db_connect( false ) ) { | |
| 533 | - $salt = $this->opdb->get_var( | |
| 534 | - $this->opdb->prepare( | |
| 535 | - "SELECT password_salt FROM {$this->opdb->prefix}user WHERE user_id = %d LIMIT 1", | |
| 536 | - $old_user_id | |
| 537 | - ) | |
| 538 | - ); | |
| 539 | - | |
| 540 | - if ( is_string( $salt ) && '' !== $salt ) { | |
| 541 | - $pass_array['salt'] = wp_slash( $salt ); | |
| 542 | - update_user_meta( $user->ID, '_bbp_password', $pass_array ); | |
| 543 | - } | |
| 544 | - } | |
| 545 | - } | |
| 546 | - } | |
| 547 | - | |
| 548 | - parent::callback_pass( $username, $password, $wp_password ); | |
| 549 | - } | |
| 550 | - | |
| 551 | - /** | |
| 552 | 525 | * This method is to take the pass out of the database and compare |
| 553 | 526 | * to a pass the user has typed in. |
| 554 | 527 | */ |
| 555 | 528 | public function authenticate_pass( $password, $serialized_pass ) { |
| @@ -554,23 +527,26 @@ | ||
| 554 | 527 | */ |
| 555 | 528 | public function authenticate_pass( $password, $serialized_pass ) { |
| 556 | 529 | |
| 557 | 530 | // Unserialize the password, with safeguards |
| 558 | - $pass_array = $this->unserialize_pass( $serialized_pass ); | |
| 531 | + $pass_array = unserialize( | |
| 532 | + $serialized_pass, | |
| 533 | + array( | |
| 534 | + 'allowed_classes' => false, | |
| 535 | + 'max_depth' => 1 | |
| 536 | + ) | |
| 537 | + ); | |
| 559 | 538 | |
| 560 | - // Bail if missing or invalid values | |
| 561 | - if ( ! is_string( $password ) || ! is_array( $pass_array ) || ! isset( $pass_array['hash'], $pass_array['salt'] ) || ! is_string( $pass_array['hash'] ) || ! is_string( $pass_array['salt'] ) ) { | |
| 539 | + // Bail if missing values | |
| 540 | + if ( ! is_array( $pass_array ) || ! isset( $pass_array['hash'], $pass_array['salt'] ) ) { | |
| 562 | 541 | return false; |
| 563 | 542 | } |
| 564 | 543 | |
| 565 | - $hash = md5( md5( $password ) . md5( $pass_array['salt'] ) ); | |
| 566 | - $old_hash = md5( md5( $password ) . $pass_array['salt'] ); | |
| 567 | - | |
| 568 | - // Retain support for metadata compatible with the historical verifier | |
| 569 | - $hash_matches = hash_equals( $pass_array['hash'], $hash ); | |
| 570 | - $old_hash_matches = hash_equals( $pass_array['hash'], $old_hash ); | |
| 571 | - | |
| 572 | - return $hash_matches || $old_hash_matches; | |
| 544 | + // Return comparison | |
| 545 | + return hash_equals( | |
| 546 | + $pass_array['hash'], | |
| 547 | + md5( md5( $password ) . $pass_array['salt'] ) | |
| 548 | + ); | |
| 573 | 549 | } |
| 574 | 550 | |
| 575 | 551 | /** |
| 576 | 552 | * Translate the forum type from PHPFox v3.5.x numerics to WordPress's strings. |
