| @@ -16,8 +16,16 @@ | ||
| 16 | 16 | */ |
| 17 | 17 | class Phorum extends BBP_Converter_Base { |
| 18 | 18 | |
| 19 | 19 | /** |
| 20 | + * Main Constructor | |
| 21 | + * | |
| 22 | + */ | |
| 23 | + public function __construct() { | |
| 24 | + parent::__construct(); | |
| 25 | + } | |
| 26 | + | |
| 27 | + /** | |
| 20 | 28 | * Sets up the field mappings |
| 21 | 29 | */ |
| 22 | 30 | public function setup_globals() { |
| 23 | 31 | |
| @@ -108,24 +116,24 @@ | ||
| 108 | 116 | // Forum dates. |
| 109 | 117 | $this->field_map[] = array( |
| 110 | 118 | 'to_type' => 'forum', |
| 111 | 119 | 'to_fieldname' => 'post_date', |
| 112 | - 'default' => date( 'Y-m-d H:i:s' ) // phpcs:ignore | |
| 120 | + 'default' => date( 'Y-m-d H:i:s' ) // phpcs:ignore WordPress.DateTime.RestrictedFunctions.date_date | |
| 113 | 121 | ); |
| 114 | 122 | $this->field_map[] = array( |
| 115 | 123 | 'to_type' => 'forum', |
| 116 | 124 | 'to_fieldname' => 'post_date_gmt', |
| 117 | - 'default' => gmdate( 'Y-m-d H:i:s' ) | |
| 125 | + 'default' => date( 'Y-m-d H:i:s' ) // phpcs:ignore WordPress.DateTime.RestrictedFunctions.date_date | |
| 118 | 126 | ); |
| 119 | 127 | $this->field_map[] = array( |
| 120 | 128 | 'to_type' => 'forum', |
| 121 | 129 | 'to_fieldname' => 'post_modified', |
| 122 | - 'default' => date( 'Y-m-d H:i:s' ) // phpcs:ignore | |
| 130 | + 'default' => date( 'Y-m-d H:i:s' ) // phpcs:ignore WordPress.DateTime.RestrictedFunctions.date_date | |
| 123 | 131 | ); |
| 124 | 132 | $this->field_map[] = array( |
| 125 | 133 | 'to_type' => 'forum', |
| 126 | 134 | 'to_fieldname' => 'post_modified_gmt', |
| 127 | - 'default' => gmdate( 'Y-m-d H:i:s' ) | |
| 135 | + 'default' => date( 'Y-m-d H:i:s' ) // phpcs:ignore WordPress.DateTime.RestrictedFunctions.date_date | |
| 128 | 136 | ); |
| 129 | 137 | |
| 130 | 138 | /** Topic Section *****************************************************/ |
| 131 | 139 | |
| @@ -425,9 +433,9 @@ | ||
| 425 | 433 | 'to_type' => 'user', |
| 426 | 434 | 'to_fieldname' => '_bbp_old_user_id' |
| 427 | 435 | ); |
| 428 | 436 | |
| 429 | - // Store old user password (Stored in serialized usermeta) | |
| 437 | + // Store old user password (Stored in usermeta serialized with salt) | |
| 430 | 438 | $this->field_map[] = array( |
| 431 | 439 | 'from_tablename' => 'users', |
| 432 | 440 | 'from_fieldname' => 'password', |
| 433 | 441 | 'to_type' => 'user', |
| @@ -434,11 +442,19 @@ | ||
| 434 | 442 | 'to_fieldname' => '_bbp_password', |
| 435 | 443 | 'callback_method' => 'callback_savepass' |
| 436 | 444 | ); |
| 437 | 445 | |
| 446 | + // Store old user salt (This is only used for the SELECT row info for the above password save) | |
| 447 | +// $this->field_map[] = array( | |
| 448 | +// 'from_tablename' => 'users', | |
| 449 | +// 'from_fieldname' => 'salt', | |
| 450 | +// 'to_type' => 'user', | |
| 451 | +// 'to_fieldname' => '' | |
| 452 | +// ); | |
| 453 | + | |
| 438 | 454 | // User password verify class (Stored in usermeta for verifying password) |
| 439 | 455 | $this->field_map[] = array( |
| 440 | - 'to_type' => 'user', | |
| 456 | + 'to_type' => 'users', | |
| 441 | 457 | 'to_fieldname' => '_bbp_class', |
| 442 | 458 | 'default' => 'Phorum' |
| 443 | 459 | ); |
| 444 | 460 | |
| @@ -501,12 +517,19 @@ | ||
| 501 | 517 | return ''; |
| 502 | 518 | } |
| 503 | 519 | |
| 504 | 520 | /** |
| 505 | - * Save the password hash in serialized usermeta. | |
| 521 | + * This method is to save the salt and password together. That | |
| 522 | + * way when we authenticate it we can get it out of the database | |
| 523 | + * as one value. Array values are auto sanitized by WordPress. | |
| 506 | 524 | */ |
| 507 | 525 | public function callback_savepass( $field, $row ) { |
| 508 | - return array( 'hash' => $field ); | |
| 526 | + $pass_array = array( | |
| 527 | + 'hash' => $field, | |
| 528 | + 'salt' => $row['salt'] | |
| 529 | + ); | |
| 530 | + | |
| 531 | + return $pass_array; | |
| 509 | 532 | } |
| 510 | 533 | |
| 511 | 534 | /** |
| 512 | 535 | * This method is to take the pass out of the database and compare |
| @@ -514,12 +537,18 @@ | ||
| 514 | 537 | */ |
| 515 | 538 | public function authenticate_pass( $password, $serialized_pass ) { |
| 516 | 539 | |
| 517 | 540 | // Unserialize the password, with safeguards |
| 518 | - $pass_array = $this->unserialize_pass( $serialized_pass ); | |
| 541 | + $pass_array = unserialize( | |
| 542 | + $serialized_pass, | |
| 543 | + array( | |
| 544 | + 'allowed_classes' => false, | |
| 545 | + 'max_depth' => 1 | |
| 546 | + ) | |
| 547 | + ); | |
| 519 | 548 | |
| 520 | - // Bail if the password hash is invalid | |
| 521 | - if ( ! is_array( $pass_array ) || ! isset( $pass_array['hash'] ) || ! is_string( $pass_array['hash'] ) ) { | |
| 549 | + // Bail if missing values | |
| 550 | + if ( ! is_array( $pass_array ) || ! isset( $pass_array['hash'], $pass_array['salt'] ) ) { | |
| 522 | 551 | return false; |
| 523 | 552 | } |
| 524 | 553 | |
| 525 | 554 | // Return comparison |
| @@ -524,9 +553,9 @@ | ||
| 524 | 553 | |
| 525 | 554 | // Return comparison |
| 526 | 555 | return hash_equals( |
| 527 | 556 | $pass_array['hash'], |
| 528 | - md5( $password ) | |
| 557 | + md5( md5( $password ) . $pass_array['salt'] ) | |
| 529 | 558 | ); |
| 530 | 559 | } |
| 531 | 560 | |
| 532 | 561 | /** |
