← All changes | inc/class-ps-conditional.php +18 -10 4.2.11 → 4.3.16 View file →

		@@ -12,21 +12,29 @@
12	12	* @return boolean
13	13	* @throws Exception
14	14	*/
15	15	public static function is_valid( array $atts ) : bool {
16		- $input = '';
17		- // is Cookie set?
	16	+ $inputs = array();
	17	+ // is Cookie set? Support multiple hashes (pipe-separated).
18	18	if ( !empty( $_COOKIE['passster'] ) ) {
19		- $input = esc_html( $_COOKIE['passster'] );
	19	+ $cookie_value = esc_html( $_COOKIE['passster'] );
	20	+ // Split by pipe to support multiple password hashes
	21	+ $inputs = array_filter( explode( '|', $cookie_value ) );
20	22	}
21		- // Valid password.
22		- if ( self::is_valid_password( $input, $atts ) ) {
23		- return true;
	23	+ // For backwards compatibility, also check single input
	24	+ $input = ( !empty( $inputs ) ? $inputs[0] : '' );
	25	+ // Valid password - check all inputs from cookie (supports multiple unlocks).
	26	+ foreach ( $inputs as $input ) {
	27	+ if ( self::is_valid_password( $input, $atts ) ) {
	28	+ return true;
	29	+ }
24	30	}
25		- // captcha.
	31	+ // captcha - check all inputs.
26	32	if ( isset( $atts['captcha'] ) ) {
27		- if ( 'captcha' == $input ) {
28		- return true;
	33	+ foreach ( $inputs as $input ) {
	34	+ if ( 'captcha' === $input ) {
	35	+ return true;
	36	+ }
29	37	}
30	38	}
31	39	// if nothing was correct.
32	40	return false;
		@@ -43,9 +51,9 @@
43	51	*/
44	52	public static function is_valid_password( string $input, array $atts ) : bool {
45	53	// password.
46	54	if ( !empty( $atts['password'] ) ) {
47		- $hash = hash_hmac( 'sha256', esc_html( $atts['password'] ), get_option( 'passster_secure_key' ) );
	55	+ $hash = hash_hmac( 'sha256', wp_unslash( $atts['password'] ), get_option( 'passster_secure_key' ) );
48	56	if ( hash_equals( $hash, $input ) ) {
49	57	return true;
50	58	}
51	59	}