Skip to content

#21022 Full bcrypt PR #8020

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
johnbillion wants to merge 62 commits into from
Closed

#21022 Full bcrypt PR #8020

johnbillion wants to merge 62 commits into from

Conversation

@johnbillion
Copy link
Member

@johnbillion johnbillion commented Dec 18, 2024

This is a temporary PR to run the tests for the full bcrypt changes including johnbillion#5 and johnbillion#6 .

Trac ticket: https://core.trac.wordpress.org/ticket/21022

@johnbillion
Begin switching the password hashing mechanism from phpass to bcrypt.
fe1c16e
@johnbillion
Update the handling of user passwords, password reset keys, and user …
82d937f 
…request keys.
@johnbillion
Update the handling of the recovery mode key.
f12e93d
@johnbillion
Update the handling of post passwords.
5a46809
@johnbillion
Automatically rehash user passwords and application passwords after t…
d4e4e47 
…hey are validated.
@johnbillion
Docs.
638421d
@johnbillion
Juggle this a bit.
316cb41
@johnbillion
Trying to get these tests in order.
76fa518
@johnbillion
More docs.
d707939
@johnbillion
Retain validity of phpass hashed password reset keys.
4a796b7
@johnbillion
Retain validity of a phpass hashed recovery mode key.
64dfd57
@johnbillion
Retain validity of phpass hashed user request keys.
e161994
@johnbillion
More docs.
548f937
@johnbillion
Add tests for password rehashing when signing in with a username or e…
fe9b053 
…mail address.
@johnbillion
Docs.
33cf000
@johnbillion
Ensure wp_check_password() remains compatible with changes to the d…
d51cbc2 
…efault bcrypt cost.
@johnbillion
Simplify this logic.
6b5441c
@johnbillion
Add tests for Argon2 support.
89e0645
@johnbillion
Always pass the return value of wp_check_password() through the `ch…
085b73c 
…eck_password` filter.
@johnbillion
Reintroduce support for the $wp_hasher global if it's set.
3e078a7
@johnbillion
Test the tests.
be636be
@johnbillion
Docs.
4265787
@johnbillion
Start splitting up and fixing these tests.
fd6bcdd
@johnbillion
Coding standards.
392e612
@johnbillion
Add a todo.
9040193
@johnbillion
Add some more assertions to the application password auth tests.
bc99ca1
@johnbillion
Correct and add tests for the application password rehashing.
58a89e2
@johnbillion
Done.
49871d0
@johnbillion
Coding standards.
b42e57b
@johnbillion
Allow either the name or password to change in order to allow an appl…
2baeb19 
…ication password to get updated.
@johnbillion
One fewer regexes in the world.
ea8c56c
@johnbillion
Merge branch 'trunk' into 21022-bcrypt
2ef2077
@johnbillion
Allow the password hashing options to be filtered.
3a951ef
@johnbillion
Docs.
53acf70
@johnbillion
Merge branch 'trunk' into 21022-bcrypt
5944d9a
@johnbillion
Cease hashing passwords as md5 during the upgrade routine and/or the …
820f48f 
…repair routine.

This prevents passwords from being hashed using md5 when they're already hashed with phpass or bcrypt.
@johnbillion
More tests for empty values.
c07e618
@johnbillion
More updates to the tests.
5d33621
@johnbillion
Add a test to verify that a password gets rehashed when the default c…
0063154 
…ost is increased.
@johnbillion
This might as well go here.
1aea250
@johnbillion
Add tests for post password handling.
d6c7837
@johnbillion
Merge branch 'trunk' into 21022-bcrypt
8b1dbd2
@johnbillion
Clear the cookie value before performing the assertions.
5824f4c
@johnbillion
Implement pre-hashing with sha384 to retain entropy of passwords over…
2502179 
… 72 bytes.
@johnbillion
Implement domain separation for the password to protect against passw…
2321412 
…ord shucking.
@johnbillion
Remove assertions that are unnecessarily specific to bcrypt.
d86ef6d
@johnbillion
The default bcrypt cost was increased in PHP 8.4.
09ddc5e
@johnbillion
Merge branch 'trunk' into 21022-bcrypt-sha2
a27411d
@johnbillion
Merge branch 'trunk' into 21022-bcrypt
e5f8d5c
@johnbillion
Merge branch '21022-bcrypt' into 21022-bcrypt-sha2
9bb86a8 
# Conflicts:
#	tests/phpunit/tests/auth.php
@johnbillion
Switch to HMAC in place of manually prepending the domain separation …
1cebd80 
…key.
@johnbillion
Introduce the wp_hash_password_algorithm filter for controlling the…
537ee4a 
… password hashing algorithm.
@johnbillion
Why.
8a99edd
@github-actions
Copy link

github-actions bot commented Dec 18, 2024

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

  • The Plugin and Theme Directories cannot be accessed within Playground.
  • All changes will be lost when closing a tab with a Playground instance.
  • All changes will be lost when refreshing the page.
  • A fresh instance is created each time the link below is clicked.
  • Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
    it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.

@johnbillion johnbillion closed this Jan 7, 2025
@johnbillion johnbillion deleted the 21022-bcrypt-algo-filter branch January 7, 2025 00:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@johnbillion