| @@ -397,9 +397,9 @@ | ||
| 397 | 397 | 'to_type' => 'user', |
| 398 | 398 | 'to_fieldname' => '_bbp_old_user_id' |
| 399 | 399 | ); |
| 400 | 400 | |
| 401 | - // Store old user password (Stored in usermeta serialized with salt) | |
| 401 | + // Store old user password (Stored in usermeta) | |
| 402 | 402 | $this->field_map[] = array( |
| 403 | 403 | 'from_tablename' => 'user', |
| 404 | 404 | 'from_fieldname' => 'user_password', |
| 405 | 405 | 'to_type' => 'user', |
| @@ -473,19 +473,13 @@ | ||
| 473 | 473 | return ''; |
| 474 | 474 | } |
| 475 | 475 | |
| 476 | 476 | /** |
| 477 | - * This method is to save the salt and password together. That | |
| 478 | - * way when we authenticate it we can get it out of the database | |
| 479 | - * as one value. Array values are auto sanitized by WordPress. | |
| 477 | + * Store the old password hash as an array. Array values are auto | |
| 478 | + * sanitized by WordPress. | |
| 480 | 479 | */ |
| 481 | 480 | public function callback_savepass( $field, $row ) { |
| 482 | - $pass_array = array( | |
| 483 | - 'hash' => $field, | |
| 484 | - 'salt' => $row['salt'] | |
| 485 | - ); | |
| 486 | - | |
| 487 | - return $pass_array; | |
| 481 | + return array( 'hash' => $field ); | |
| 488 | 482 | } |
| 489 | 483 | |
| 490 | 484 | /** |
| 491 | 485 | * This method is to take the pass out of the database and compare |
| @@ -493,26 +487,38 @@ | ||
| 493 | 487 | */ |
| 494 | 488 | public function authenticate_pass( $password, $serialized_pass ) { |
| 495 | 489 | |
| 496 | 490 | // Unserialize the password, with safeguards |
| 497 | - $pass_array = unserialize( | |
| 498 | - $serialized_pass, | |
| 499 | - array( | |
| 500 | - 'allowed_classes' => false, | |
| 501 | - 'max_depth' => 1 | |
| 502 | - ) | |
| 503 | - ); | |
| 491 | + $pass_array = $this->unserialize_pass( $serialized_pass ); | |
| 504 | 492 | |
| 505 | - // Bail if missing values | |
| 506 | - if ( ! is_array( $pass_array ) || ! isset( $pass_array['hash'], $pass_array['salt'] ) ) { | |
| 493 | + // Bail if missing or invalid values | |
| 494 | + if ( ! is_string( $password ) || ! is_array( $pass_array ) || ! isset( $pass_array['hash'] ) || ! is_string( $pass_array['hash'] ) ) { | |
| 507 | 495 | return false; |
| 508 | 496 | } |
| 509 | 497 | |
| 510 | - // Return comparison | |
| 511 | - return hash_equals( | |
| 512 | - $pass_array['hash'], | |
| 513 | - md5( md5( $password ) . $pass_array['salt'] ) | |
| 514 | - ); | |
| 498 | + // Standard e107 v1 password comparison | |
| 499 | + if ( hash_equals( $pass_array['hash'], md5( $password ) ) ) { | |
| 500 | + return true; | |
| 501 | + } | |
| 502 | + | |
| 503 | + // e107 also converted UTF-8 passwords for upgraded legacy sites | |
| 504 | + if ( function_exists( 'mb_convert_encoding' ) && function_exists( 'mb_substitute_character' ) ) { | |
| 505 | + $substitute_character = mb_substitute_character(); | |
| 506 | + | |
| 507 | + if ( false === $substitute_character || ! mb_substitute_character( 0x3F ) ) { | |
| 508 | + return false; | |
| 509 | + } | |
| 510 | + | |
| 511 | + try { | |
| 512 | + $legacy_password = mb_convert_encoding( $password, 'ISO-8859-1', 'UTF-8' ); | |
| 513 | + } finally { | |
| 514 | + mb_substitute_character( $substitute_character ); | |
| 515 | + } | |
| 516 | + | |
| 517 | + return hash_equals( $pass_array['hash'], md5( $legacy_password ) ); | |
| 518 | + } | |
| 519 | + | |
| 520 | + return false; | |
| 515 | 521 | } |
| 516 | 522 | |
| 517 | 523 | /** |
| 518 | 524 | * Translate the forum type from e107 v1.x numerics to WordPress's strings. |
