Skip to content

Commit 68c4efc

Browse files
SergeyBiryukovSergeyBiryukov
committed
Privacy: Use SHA-256 hashing algorithm for Gravatar.
This aims to improve privacy by switching to a more secure algorithm, as an MD5 string can be reversed. Follow-up to [6748], [31107]. Props henry.wright, jucaduca, haozi, desrosj, dd32, SergeyBiryukov. See #60638. git-svn-id: https://develop.svn.wordpress.org/trunk@59532 602fd350-edb4-49c9-b593-d223f7449a82
1 parent c697356 commit 68c4efc

File tree

4 files changed

+38
-31
lines changed

4 files changed

+38
-31
lines changed

‎src/wp-includes/link-template.php‎

Lines changed: 11 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -4289,7 +4289,7 @@ function the_shortlink( $text = '', $title = '', $before = '', $after = '' ) {
42894289
*
42904290
* @since 4.2.0
42914291
*
4292-
* @param mixed $id_or_email The avatar to retrieve a URL for. Accepts a user ID, Gravatar MD5 hash,
4292+
* @param mixed $id_or_email The avatar to retrieve a URL for. Accepts a user ID, Gravatar SHA-256 or MD5 hash,
42934293
* user email, WP_User object, WP_Post object, or WP_Comment object.
42944294
* @param array $args {
42954295
* Optional. Arguments to use instead of the default arguments.
@@ -4353,8 +4353,9 @@ function is_avatar_comment_type( $comment_type ) {
43534353
*
43544354
* @since 4.2.0
43554355
* @since 6.7.0 Gravatar URLs always use HTTPS.
4356+
* @since 6.8.0 Gravatar URLs use the SHA-256 hashing algorithm.
43564357
*
4357-
* @param mixed $id_or_email The avatar to retrieve. Accepts a user ID, Gravatar MD5 hash,
4358+
* @param mixed $id_or_email The avatar to retrieve. Accepts a user ID, Gravatar SHA-256 or MD5 hash,
43584359
* user email, WP_User object, WP_Post object, or WP_Comment object.
43594360
* @param array $args {
43604361
* Optional. Arguments to use instead of the default arguments.
@@ -4474,7 +4475,7 @@ function get_avatar_data( $id_or_email, $args = null ) {
44744475
* @since 4.2.0
44754476
*
44764477
* @param array $args Arguments passed to get_avatar_data(), after processing.
4477-
* @param mixed $id_or_email The avatar to retrieve. Accepts a user ID, Gravatar MD5 hash,
4478+
* @param mixed $id_or_email The avatar to retrieve. Accepts a user ID, Gravatar SHA-256 or MD5 hash,
44784479
* user email, WP_User object, WP_Post object, or WP_Comment object.
44794480
*/
44804481
$args = apply_filters( 'pre_get_avatar_data', $args, $id_or_email );
@@ -4496,7 +4497,10 @@ function get_avatar_data( $id_or_email, $args = null ) {
44964497
if ( is_numeric( $id_or_email ) ) {
44974498
$user = get_user_by( 'id', absint( $id_or_email ) );
44984499
} elseif ( is_string( $id_or_email ) ) {
4499-
if ( str_contains( $id_or_email, '@md5.gravatar.com' ) ) {
4500+
if ( str_contains( $id_or_email, '@sha256.gravatar.com' ) ) {
4501+
// SHA-256 hash.
4502+
list( $email_hash ) = explode( '@', $id_or_email );
4503+
} else if ( str_contains( $id_or_email, '@md5.gravatar.com' ) ) {
45004504
// MD5 hash.
45014505
list( $email_hash ) = explode( '@', $id_or_email );
45024506
} else {
@@ -4530,7 +4534,7 @@ function get_avatar_data( $id_or_email, $args = null ) {
45304534
}
45314535

45324536
if ( $email ) {
4533-
$email_hash = md5( strtolower( trim( $email ) ) );
4537+
$email_hash = hash( 'sha256', strtolower( trim( $email ) ) );
45344538
}
45354539
}
45364540

@@ -4564,7 +4568,7 @@ function get_avatar_data( $id_or_email, $args = null ) {
45644568
* @since 4.2.0
45654569
*
45664570
* @param string $url The URL of the avatar.
4567-
* @param mixed $id_or_email The avatar to retrieve. Accepts a user ID, Gravatar MD5 hash,
4571+
* @param mixed $id_or_email The avatar to retrieve. Accepts a user ID, Gravatar SHA-256 or MD5 hash,
45684572
* user email, WP_User object, WP_Post object, or WP_Comment object.
45694573
* @param array $args Arguments passed to get_avatar_data(), after processing.
45704574
*/
@@ -4576,7 +4580,7 @@ function get_avatar_data( $id_or_email, $args = null ) {
45764580
* @since 4.2.0
45774581
*
45784582
* @param array $args Arguments passed to get_avatar_data(), after processing.
4579-
* @param mixed $id_or_email The avatar to retrieve. Accepts a user ID, Gravatar MD5 hash,
4583+
* @param mixed $id_or_email The avatar to retrieve. Accepts a user ID, Gravatar SHA-256 or MD5 hash,
45804584
* user email, WP_User object, WP_Post object, or WP_Comment object.
45814585
*/
45824586
return apply_filters( 'get_avatar_data', $args, $id_or_email );

‎tests/phpunit/tests/avatar.php‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ class Tests_Avatar extends WP_UnitTestCase {
1111
*/
1212
public function test_get_avatar_url_gravatar_url() {
1313
$url = get_avatar_url( 1 );
14-
$this->assertSame( preg_match( '|^https?://secure.gravatar.com/avatar/[0-9a-f]{32}\?|', $url ), 1 );
14+
$this->assertSame( preg_match( '|^https?://secure.gravatar.com/avatar/[0-9a-f]{64}\?|', $url ), 1 );
1515
}
1616

1717
/**
@@ -90,9 +90,12 @@ public function test_get_avatar_url_user() {
9090
$url2 = get_avatar_url( WP_TESTS_EMAIL );
9191
$this->assertSame( $url, $url2 );
9292

93-
$url2 = get_avatar_url( md5( WP_TESTS_EMAIL ) . '@md5.gravatar.com' );
93+
$url2 = get_avatar_url( hash( 'sha256', WP_TESTS_EMAIL ) . '@sha256.gravatar.com' );
9494
$this->assertSame( $url, $url2 );
9595

96+
$url2 = get_avatar_url( md5( WP_TESTS_EMAIL ) . '@md5.gravatar.com' );
97+
$this->assertSame( preg_match( '|^https?://secure.gravatar.com/avatar/[0-9a-f]{32}\?|', $url2 ), 1 );
98+
9699
$user = get_user_by( 'id', 1 );
97100
$url2 = get_avatar_url( $user );
98101
$this->assertSame( $url, $url2 );
@@ -267,7 +270,7 @@ public function test_get_avatar_data_should_return_gravatar_url_when_input_avata
267270
$actual_data = get_avatar_data( $comment );
268271

269272
$this->assertTrue( is_avatar_comment_type( $comment_type ) );
270-
$this->assertMatchesRegularExpression( '|^https?://secure.gravatar.com/avatar/[0-9a-f]{32}\?|', $actual_data['url'] );
273+
$this->assertMatchesRegularExpression( '|^https?://secure.gravatar.com/avatar/[0-9a-f]{64}\?|', $actual_data['url'] );
271274
}
272275

273276
/**

‎tests/phpunit/tests/rest-api/rest-schema-setup.php‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -729,9 +729,9 @@ public function test_build_wp_api_client_fixtures() {
729729
'TagModel.meta.test_multi' => array(),
730730
'TagModel.meta.test_tag_meta' => '',
731731
'UsersCollection.0.link' => 'http://example.org/?author=1',
732-
'UsersCollection.0.avatar_urls.24' => 'https://secure.gravatar.com/avatar/96614ec98aa0c0d2ee75796dced6df54?s=24&d=mm&r=g',
733-
'UsersCollection.0.avatar_urls.48' => 'https://secure.gravatar.com/avatar/96614ec98aa0c0d2ee75796dced6df54?s=48&d=mm&r=g',
734-
'UsersCollection.0.avatar_urls.96' => 'https://secure.gravatar.com/avatar/96614ec98aa0c0d2ee75796dced6df54?s=96&d=mm&r=g',
732+
'UsersCollection.0.avatar_urls.24' => 'https://secure.gravatar.com/avatar/9387ed9432ec25ef93df84b8a0b9697ddef435a945e7f244670c4f79f88363e9?s=24&d=mm&r=g',
733+
'UsersCollection.0.avatar_urls.48' => 'https://secure.gravatar.com/avatar/9387ed9432ec25ef93df84b8a0b9697ddef435a945e7f244670c4f79f88363e9?s=48&d=mm&r=g',
734+
'UsersCollection.0.avatar_urls.96' => 'https://secure.gravatar.com/avatar/9387ed9432ec25ef93df84b8a0b9697ddef435a945e7f244670c4f79f88363e9?s=96&d=mm&r=g',
735735
'UsersCollection.0._links.self.0.href' => 'http://example.org/index.php?rest_route=/wp/v2/users/1',
736736
'UsersCollection.0._links.collection.0.href' => 'http://example.org/index.php?rest_route=/wp/v2/users',
737737
'UsersCollection.1.id' => 2,

‎tests/qunit/fixtures/wp-api-generated.js‎

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -13877,9 +13877,9 @@ mockedApiResponse.UsersCollection = [
1387713877
"link": "http://example.org/?author=1",
1387813878
"slug": "admin",
1387913879
"avatar_urls": {
13880-
"24": "https://secure.gravatar.com/avatar/96614ec98aa0c0d2ee75796dced6df54?s=24&d=mm&r=g",
13881-
"48": "https://secure.gravatar.com/avatar/96614ec98aa0c0d2ee75796dced6df54?s=48&d=mm&r=g",
13882-
"96": "https://secure.gravatar.com/avatar/96614ec98aa0c0d2ee75796dced6df54?s=96&d=mm&r=g"
13880+
"24": "https://secure.gravatar.com/avatar/9387ed9432ec25ef93df84b8a0b9697ddef435a945e7f244670c4f79f88363e9?s=24&d=mm&r=g",
13881+
"48": "https://secure.gravatar.com/avatar/9387ed9432ec25ef93df84b8a0b9697ddef435a945e7f244670c4f79f88363e9?s=48&d=mm&r=g",
13882+
"96": "https://secure.gravatar.com/avatar/9387ed9432ec25ef93df84b8a0b9697ddef435a945e7f244670c4f79f88363e9?s=96&d=mm&r=g"
1388313883
},
1388413884
"meta": {
1388513885
"meta_key": "meta_value"
@@ -13914,9 +13914,9 @@ mockedApiResponse.UsersCollection = [
1391413914
"link": "http://example.org/?author=2",
1391513915
"slug": "restapiclientfixtureuser",
1391613916
"avatar_urls": {
13917-
"24": "https://secure.gravatar.com/avatar/57cbd982c963c7eb2294e2eee1b4448e?s=24&d=mm&r=g",
13918-
"48": "https://secure.gravatar.com/avatar/57cbd982c963c7eb2294e2eee1b4448e?s=48&d=mm&r=g",
13919-
"96": "https://secure.gravatar.com/avatar/57cbd982c963c7eb2294e2eee1b4448e?s=96&d=mm&r=g"
13917+
"24": "https://secure.gravatar.com/avatar/ea862d9636c72500beece7b1990870e2776f89c2096d0c064c14f2beb910077d?s=24&d=mm&r=g",
13918+
"48": "https://secure.gravatar.com/avatar/ea862d9636c72500beece7b1990870e2776f89c2096d0c064c14f2beb910077d?s=48&d=mm&r=g",
13919+
"96": "https://secure.gravatar.com/avatar/ea862d9636c72500beece7b1990870e2776f89c2096d0c064c14f2beb910077d?s=96&d=mm&r=g"
1392013920
},
1392113921
"meta": {
1392213922
"meta_key": ""
@@ -13953,9 +13953,9 @@ mockedApiResponse.UserModel = {
1395313953
"link": "http://example.org/?author=2",
1395413954
"slug": "restapiclientfixtureuser",
1395513955
"avatar_urls": {
13956-
"24": "https://secure.gravatar.com/avatar/57cbd982c963c7eb2294e2eee1b4448e?s=24&d=mm&r=g",
13957-
"48": "https://secure.gravatar.com/avatar/57cbd982c963c7eb2294e2eee1b4448e?s=48&d=mm&r=g",
13958-
"96": "https://secure.gravatar.com/avatar/57cbd982c963c7eb2294e2eee1b4448e?s=96&d=mm&r=g"
13956+
"24": "https://secure.gravatar.com/avatar/ea862d9636c72500beece7b1990870e2776f89c2096d0c064c14f2beb910077d?s=24&d=mm&r=g",
13957+
"48": "https://secure.gravatar.com/avatar/ea862d9636c72500beece7b1990870e2776f89c2096d0c064c14f2beb910077d?s=48&d=mm&r=g",
13958+
"96": "https://secure.gravatar.com/avatar/ea862d9636c72500beece7b1990870e2776f89c2096d0c064c14f2beb910077d?s=96&d=mm&r=g"
1395913959
},
1396013960
"meta": {
1396113961
"meta_key": ""
@@ -13970,9 +13970,9 @@ mockedApiResponse.me = {
1397013970
"link": "http://example.org/?author=2",
1397113971
"slug": "restapiclientfixtureuser",
1397213972
"avatar_urls": {
13973-
"24": "https://secure.gravatar.com/avatar/57cbd982c963c7eb2294e2eee1b4448e?s=24&d=mm&r=g",
13974-
"48": "https://secure.gravatar.com/avatar/57cbd982c963c7eb2294e2eee1b4448e?s=48&d=mm&r=g",
13975-
"96": "https://secure.gravatar.com/avatar/57cbd982c963c7eb2294e2eee1b4448e?s=96&d=mm&r=g"
13973+
"24": "https://secure.gravatar.com/avatar/ea862d9636c72500beece7b1990870e2776f89c2096d0c064c14f2beb910077d?s=24&d=mm&r=g",
13974+
"48": "https://secure.gravatar.com/avatar/ea862d9636c72500beece7b1990870e2776f89c2096d0c064c14f2beb910077d?s=48&d=mm&r=g",
13975+
"96": "https://secure.gravatar.com/avatar/ea862d9636c72500beece7b1990870e2776f89c2096d0c064c14f2beb910077d?s=96&d=mm&r=g"
1397613976
},
1397713977
"meta": {
1397813978
"meta_key": ""
@@ -13996,9 +13996,9 @@ mockedApiResponse.CommentsCollection = [
1399613996
"status": "approved",
1399713997
"type": "comment",
1399813998
"author_avatar_urls": {
13999-
"24": "https://secure.gravatar.com/avatar/bd7c2b505bcf39cc71cfee564c614956?s=24&d=mm&r=g",
14000-
"48": "https://secure.gravatar.com/avatar/bd7c2b505bcf39cc71cfee564c614956?s=48&d=mm&r=g",
14001-
"96": "https://secure.gravatar.com/avatar/bd7c2b505bcf39cc71cfee564c614956?s=96&d=mm&r=g"
13999+
"24": "https://secure.gravatar.com/avatar/9ca51ced0b389ffbeba3d269c6d824be664c84fa1b35503282abdd302e1f417c?s=24&d=mm&r=g",
14000+
"48": "https://secure.gravatar.com/avatar/9ca51ced0b389ffbeba3d269c6d824be664c84fa1b35503282abdd302e1f417c?s=48&d=mm&r=g",
14001+
"96": "https://secure.gravatar.com/avatar/9ca51ced0b389ffbeba3d269c6d824be664c84fa1b35503282abdd302e1f417c?s=96&d=mm&r=g"
1400214002
},
1400314003
"meta": {
1400414004
"meta_key": "meta_value"
@@ -14050,9 +14050,9 @@ mockedApiResponse.CommentModel = {
1405014050
"status": "approved",
1405114051
"type": "comment",
1405214052
"author_avatar_urls": {
14053-
"24": "https://secure.gravatar.com/avatar/bd7c2b505bcf39cc71cfee564c614956?s=24&d=mm&r=g",
14054-
"48": "https://secure.gravatar.com/avatar/bd7c2b505bcf39cc71cfee564c614956?s=48&d=mm&r=g",
14055-
"96": "https://secure.gravatar.com/avatar/bd7c2b505bcf39cc71cfee564c614956?s=96&d=mm&r=g"
14053+
"24": "https://secure.gravatar.com/avatar/9ca51ced0b389ffbeba3d269c6d824be664c84fa1b35503282abdd302e1f417c?s=24&d=mm&r=g",
14054+
"48": "https://secure.gravatar.com/avatar/9ca51ced0b389ffbeba3d269c6d824be664c84fa1b35503282abdd302e1f417c?s=48&d=mm&r=g",
14055+
"96": "https://secure.gravatar.com/avatar/9ca51ced0b389ffbeba3d269c6d824be664c84fa1b35503282abdd302e1f417c?s=96&d=mm&r=g"
1405614056
},
1405714057
"meta": {
1405814058
"meta_key": "meta_value"

0 commit comments

Comments
 (0)