| @@ -9,9 +9,9 @@ | ||
| 9 | 9 | |
| 10 | 10 | /** |
| 11 | 11 | * Implementation of Phorum Forum converter. |
| 12 | 12 | * |
| 13 | - * @since 2.5.0 bbPress (r5141) | |
| 13 | + * @since 2.5.0 bbPress (r5142) | |
| 14 | 14 | * |
| 15 | 15 | * @link Codex Docs https://codex.bbpress.org/import-forums/phorum |
| 16 | 16 | */ |
| 17 | 17 | class Phorum extends BBP_Converter_Base { |
| @@ -433,9 +433,9 @@ | ||
| 433 | 433 | 'to_type' => 'user', |
| 434 | 434 | 'to_fieldname' => '_bbp_old_user_id' |
| 435 | 435 | ); |
| 436 | 436 | |
| 437 | - // Store old user password (Stored in usermeta serialized with salt) | |
| 437 | + // Store old user password (Stored in serialized usermeta) | |
| 438 | 438 | $this->field_map[] = array( |
| 439 | 439 | 'from_tablename' => 'users', |
| 440 | 440 | 'from_fieldname' => 'password', |
| 441 | 441 | 'to_type' => 'user', |
| @@ -442,19 +442,11 @@ | ||
| 442 | 442 | 'to_fieldname' => '_bbp_password', |
| 443 | 443 | 'callback_method' => 'callback_savepass' |
| 444 | 444 | ); |
| 445 | 445 | |
| 446 | - // Store old user salt (This is only used for the SELECT row info for the above password save) | |
| 447 | -// $this->field_map[] = array( | |
| 448 | -// 'from_tablename' => 'users', | |
| 449 | -// 'from_fieldname' => 'salt', | |
| 450 | -// 'to_type' => 'user', | |
| 451 | -// 'to_fieldname' => '' | |
| 452 | -// ); | |
| 453 | - | |
| 454 | 446 | // User password verify class (Stored in usermeta for verifying password) |
| 455 | 447 | $this->field_map[] = array( |
| 456 | - 'to_type' => 'users', | |
| 448 | + 'to_type' => 'user', | |
| 457 | 449 | 'to_fieldname' => '_bbp_class', |
| 458 | 450 | 'default' => 'Phorum' |
| 459 | 451 | ); |
| 460 | 452 | |
| @@ -517,19 +509,12 @@ | ||
| 517 | 509 | return ''; |
| 518 | 510 | } |
| 519 | 511 | |
| 520 | 512 | /** |
| 521 | - * This method is to save the salt and password together. That | |
| 522 | - * way when we authenticate it we can get it out of the database | |
| 523 | - * as one value. Array values are auto sanitized by WordPress. | |
| 513 | + * Save the password hash in serialized usermeta. | |
| 524 | 514 | */ |
| 525 | 515 | public function callback_savepass( $field, $row ) { |
| 526 | - $pass_array = array( | |
| 527 | - 'hash' => $field, | |
| 528 | - 'salt' => $row['salt'] | |
| 529 | - ); | |
| 530 | - | |
| 531 | - return $pass_array; | |
| 516 | + return array( 'hash' => $field ); | |
| 532 | 517 | } |
| 533 | 518 | |
| 534 | 519 | /** |
| 535 | 520 | * This method is to take the pass out of the database and compare |
| @@ -537,18 +522,12 @@ | ||
| 537 | 522 | */ |
| 538 | 523 | public function authenticate_pass( $password, $serialized_pass ) { |
| 539 | 524 | |
| 540 | 525 | // Unserialize the password, with safeguards |
| 541 | - $pass_array = unserialize( | |
| 542 | - $serialized_pass, | |
| 543 | - array( | |
| 544 | - 'allowed_classes' => false, | |
| 545 | - 'max_depth' => 1 | |
| 546 | - ) | |
| 547 | - ); | |
| 526 | + $pass_array = $this->unserialize_pass( $serialized_pass ); | |
| 548 | 527 | |
| 549 | - // Bail if missing values | |
| 550 | - if ( ! is_array( $pass_array ) || ! isset( $pass_array['hash'], $pass_array['salt'] ) ) { | |
| 528 | + // Bail if the password hash is invalid | |
| 529 | + if ( ! is_array( $pass_array ) || ! isset( $pass_array['hash'] ) || ! is_string( $pass_array['hash'] ) ) { | |
| 551 | 530 | return false; |
| 552 | 531 | } |
| 553 | 532 | |
| 554 | 533 | // Return comparison |
| @@ -553,9 +532,9 @@ | ||
| 553 | 532 | |
| 554 | 533 | // Return comparison |
| 555 | 534 | return hash_equals( |
| 556 | 535 | $pass_array['hash'], |
| 557 | - md5( md5( $password ) . $pass_array['salt'] ) | |
| 536 | + md5( $password ) | |
| 558 | 537 | ); |
| 559 | 538 | } |
| 560 | 539 | |
| 561 | 540 | /** |
