| @@ -9,9 +9,9 @@ | ||
| 9 | 9 | |
| 10 | 10 | /** |
| 11 | 11 | * Implementation of MyBB Forum converter. |
| 12 | 12 | * |
| 13 | - * @since 2.5.0 bbPress (r5140) | |
| 13 | + * @since 2.5.0 bbPress (r5141) | |
| 14 | 14 | * |
| 15 | 15 | * @link Codex Docs https://codex.bbpress.org/import-forums/mybb |
| 16 | 16 | */ |
| 17 | 17 | class MyBB extends BBP_Converter_Base { |
| @@ -412,9 +412,9 @@ | ||
| 412 | 412 | ); |
| 413 | 413 | |
| 414 | 414 | // User password verify class (Stored in usermeta for verifying password) |
| 415 | 415 | $this->field_map[] = array( |
| 416 | - 'to_type' => 'users', | |
| 416 | + 'to_type' => 'user', | |
| 417 | 417 | 'to_fieldname' => '_bbp_class', |
| 418 | 418 | 'default' => 'MyBB' |
| 419 | 419 | ); |
| 420 | 420 | |
| @@ -524,9 +524,9 @@ | ||
| 524 | 524 | */ |
| 525 | 525 | public function callback_savepass( $field, $row ) { |
| 526 | 526 | $pass_array = array( |
| 527 | 527 | 'hash' => $field, |
| 528 | - 'salt' => $row['salt'] | |
| 528 | + 'salt' => isset( $row['salt'] ) ? wp_slash( (string) $row['salt'] ) : '' | |
| 529 | 529 | ); |
| 530 | 530 | |
| 531 | 531 | return $pass_array; |
| 532 | 532 | } |
| @@ -537,18 +537,12 @@ | ||
| 537 | 537 | */ |
| 538 | 538 | public function authenticate_pass( $password, $serialized_pass ) { |
| 539 | 539 | |
| 540 | 540 | // Unserialize the password, with safeguards |
| 541 | - $pass_array = unserialize( | |
| 542 | - $serialized_pass, | |
| 543 | - array( | |
| 544 | - 'allowed_classes' => false, | |
| 545 | - 'max_depth' => 1 | |
| 546 | - ) | |
| 547 | - ); | |
| 541 | + $pass_array = $this->unserialize_pass( $serialized_pass ); | |
| 548 | 542 | |
| 549 | - // Bail if missing values | |
| 550 | - if ( ! is_array( $pass_array ) || ! isset( $pass_array['hash'], $pass_array['salt'] ) ) { | |
| 543 | + // Bail if missing or invalid values | |
| 544 | + if ( ! is_array( $pass_array ) || ! isset( $pass_array['hash'], $pass_array['salt'] ) || ! is_string( $pass_array['hash'] ) || ! is_string( $pass_array['salt'] ) ) { | |
| 551 | 545 | return false; |
| 552 | 546 | } |
| 553 | 547 | |
| 554 | 548 | // Return comparison |
| @@ -553,9 +547,9 @@ | ||
| 553 | 547 | |
| 554 | 548 | // Return comparison |
| 555 | 549 | return hash_equals( |
| 556 | 550 | $pass_array['hash'], |
| 557 | - md5( md5( $password ) . $pass_array['salt'] ) | |
| 551 | + md5( md5( $pass_array['salt'] ) . md5( $password ) ) | |
| 558 | 552 | ); |
| 559 | 553 | } |
| 560 | 554 | |
| 561 | 555 | /** |
