| @@ -9,9 +9,9 @@ | ||
| 9 | 9 | |
| 10 | 10 | /** |
| 11 | 11 | * Implementation of Kunena v1.x Forums for Joomla Forum converter. |
| 12 | 12 | * |
| 13 | - * @since 2.5.0 bbPress (r5144) | |
| 13 | + * @since 2.5.0 bbPress (r5145) | |
| 14 | 14 | * |
| 15 | 15 | * @link Codex Docs https://codex.bbpress.org/import-forums/kunena/ |
| 16 | 16 | */ |
| 17 | 17 | class Kunena1 extends BBP_Converter_Base { |
| @@ -397,22 +397,14 @@ | ||
| 397 | 397 | 'to_fieldname' => '_bbp_password', |
| 398 | 398 | 'callback_method' => 'callback_savepass' |
| 399 | 399 | ); |
| 400 | 400 | |
| 401 | - // Store old user salt (This is only used for the SELECT row info for the above password save) | |
| 402 | -// $this->field_map[] = array( | |
| 403 | -// 'from_tablename' => 'user', | |
| 404 | -// 'from_fieldname' => 'salt', | |
| 405 | -// 'to_type' => 'user', | |
| 406 | -// 'to_fieldname' => '' | |
| 407 | -// ); | |
| 408 | - | |
| 409 | 401 | // User password verify class (Stored in usermeta for verifying password) |
| 410 | -// $this->field_map[] = array( | |
| 411 | -// 'to_type' => 'user', | |
| 412 | -// 'to_fieldname' => '_bbp_class', | |
| 413 | -// 'default' => 'Kunena1' | |
| 414 | -// ); | |
| 402 | + $this->field_map[] = array( | |
| 403 | + 'to_type' => 'user', | |
| 404 | + 'to_fieldname' => '_bbp_class', | |
| 405 | + 'default' => 'Kunena1' | |
| 406 | + ); | |
| 415 | 407 | |
| 416 | 408 | // User name. |
| 417 | 409 | $this->field_map[] = array( |
| 418 | 410 | 'from_tablename' => 'users', |
| @@ -452,13 +444,9 @@ | ||
| 452 | 444 | * way when we authenticate it we can get it out of the database |
| 453 | 445 | * as one value. Array values are auto sanitized by WordPress. |
| 454 | 446 | */ |
| 455 | 447 | public function callback_savepass( $field, $row ) { |
| 456 | - $pass_array = array( | |
| 457 | - 'hash' => $field, | |
| 458 | - 'salt' => $row['salt'] | |
| 459 | - ); | |
| 460 | - return $pass_array; | |
| 448 | + return array( 'hash' => $field ); | |
| 461 | 449 | } |
| 462 | 450 | |
| 463 | 451 | /** |
| 464 | 452 | * This method is to take the pass out of the database and compare |
| @@ -466,26 +454,19 @@ | ||
| 466 | 454 | */ |
| 467 | 455 | public function authenticate_pass( $password, $serialized_pass ) { |
| 468 | 456 | |
| 469 | 457 | // Unserialize the password, with safeguards |
| 470 | - $pass_array = unserialize( | |
| 471 | - $serialized_pass, | |
| 472 | - array( | |
| 473 | - 'allowed_classes' => false, | |
| 474 | - 'max_depth' => 1 | |
| 475 | - ) | |
| 476 | - ); | |
| 458 | + $pass_array = $this->unserialize_pass( $serialized_pass ); | |
| 477 | 459 | |
| 478 | - // Bail if missing values | |
| 479 | - if ( ! is_array( $pass_array ) || ! isset( $pass_array['hash'], $pass_array['salt'] ) ) { | |
| 460 | + // Bail if missing or invalid values | |
| 461 | + if ( ! is_string( $password ) || ! is_array( $pass_array ) || ! isset( $pass_array['hash'] ) || ! is_string( $pass_array['hash'] ) ) { | |
| 480 | 462 | return false; |
| 481 | 463 | } |
| 482 | 464 | |
| 483 | - // Return comparison | |
| 484 | - return hash_equals( | |
| 485 | - $pass_array['hash'], | |
| 486 | - md5( md5( $password ) . $pass_array['salt'] ) | |
| 487 | - ); | |
| 465 | + $parts = explode( ':', $pass_array['hash'], 2 ); | |
| 466 | + $salt = isset( $parts[1] ) ? $parts[1] : ''; | |
| 467 | + | |
| 468 | + return hash_equals( $parts[0], md5( $password . $salt ) ); | |
| 488 | 469 | } |
| 489 | 470 | |
| 490 | 471 | /** |
| 491 | 472 | * Translate the forum type from Kunena v1.x numerics to WordPress's strings. |
