Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

#21022 Full bcrypt PR #8020

Draft
wants to merge 61 commits into
base: trunk
Choose a base branch
from
Draft

#21022 Full bcrypt PR #8020

wants to merge 61 commits into from
+1,165 −146

Conversation

johnbillion
Copy link
Member

This is a temporary PR to run the tests for the full bcrypt changes including johnbillion#5 and johnbillion#6 .

Trac ticket: https://core.trac.wordpress.org/ticket/21022

@johnbillion
Begin switching the password hashing mechanism from phpass to bcrypt.
fe1c16e
@johnbillion
Update the handling of user passwords, password reset keys, and user …
82d937f 
…request keys.
@johnbillion
Update the handling of the recovery mode key.
f12e93d
@johnbillion
Update the handling of post passwords.
5a46809
@johnbillion
Automatically rehash user passwords and application passwords after t…
d4e4e47 
…hey are validated.
@johnbillion
Docs.
638421d
@johnbillion
Juggle this a bit.
316cb41
@johnbillion
Trying to get these tests in order.
76fa518
@johnbillion
More docs.
d707939
@johnbillion
Retain validity of phpass hashed password reset keys.
4a796b7
@johnbillion
Retain validity of a phpass hashed recovery mode key.
64dfd57
@johnbillion
Retain validity of phpass hashed user request keys.
e161994
@johnbillion
More docs.
548f937
@johnbillion
Add tests for password rehashing when signing in with a username or e…
fe9b053 
…mail address.
@johnbillion
Docs.
33cf000
@johnbillion
Ensure wp_check_password() remains compatible with changes to the d…
d51cbc2 
…efault bcrypt cost.
@johnbillion
Simplify this logic.
6b5441c
@johnbillion
Add tests for Argon2 support.
89e0645
@johnbillion
Always pass the return value of wp_check_password() through the `ch…
085b73c 
…eck_password` filter.
@johnbillion
Reintroduce support for the $wp_hasher global if it's set.
3e078a7
@johnbillion
Test the tests.
be636be
@johnbillion
Docs.
4265787
@johnbillion
Start splitting up and fixing these tests.
fd6bcdd
@johnbillion
Coding standards.
392e612
@johnbillion
Add a todo.
9040193
@johnbillion
Add some more assertions to the application password auth tests.
bc99ca1
@johnbillion
Correct and add tests for the application password rehashing.
58a89e2
@johnbillion
Done.
49871d0
@johnbillion
Coding standards.
b42e57b
@johnbillion
Allow either the name or password to change in order to allow an appl…
2baeb19 
…ication password to get updated.
@johnbillion
Docs.
ff85df2
@johnbillion
Add a test to ensure the user's account password isn't touched when r…
ebcdd26 
…ehashing an application password.
@johnbillion
Merge branch 'trunk' into 21022-bcrypt
140b9d4
@johnbillion
One fewer regexes in the world.
ea8c56c
@johnbillion
Merge branch 'trunk' into 21022-bcrypt
2ef2077
@johnbillion
Allow the password hashing options to be filtered.
3a951ef
@johnbillion
Docs.
53acf70
@johnbillion
Merge branch 'trunk' into 21022-bcrypt
5944d9a
@johnbillion
Cease hashing passwords as md5 during the upgrade routine and/or the …
820f48f 
…repair routine.

This prevents passwords from being hashed using md5 when they're already hashed with phpass or bcrypt.
@johnbillion
More tests for empty values.
c07e618
@johnbillion
More updates to the tests.
5d33621
@johnbillion
Add a test to verify that a password gets rehashed when the default c…
0063154 
…ost is increased.
@johnbillion
This might as well go here.
1aea250
@johnbillion
Add tests for post password handling.
d6c7837
@johnbillion
Merge branch 'trunk' into 21022-bcrypt
8b1dbd2
@johnbillion
Clear the cookie value before performing the assertions.
5824f4c
@johnbillion
Implement pre-hashing with sha384 to retain entropy of passwords over…
2502179 
… 72 bytes.
@johnbillion
Implement domain separation for the password to protect against passw…
2321412 
…ord shucking.
@johnbillion
Remove assertions that are unnecessarily specific to bcrypt.
d86ef6d
@johnbillion
The default bcrypt cost was increased in PHP 8.4.
09ddc5e
@johnbillion
Merge branch 'trunk' into 21022-bcrypt-sha2
a27411d
@johnbillion
Merge branch 'trunk' into 21022-bcrypt
e5f8d5c
@johnbillion
Merge branch '21022-bcrypt' into 21022-bcrypt-sha2
9bb86a8 
# Conflicts:
#	tests/phpunit/tests/auth.php
@johnbillion
Switch to HMAC in place of manually prepending the domain separation …
1cebd80 
…key.
@johnbillion
Introduce the wp_hash_password_algorithm filter for controlling the…
537ee4a 
… password hashing algorithm.
@johnbillion
Why.
8a99edd
@github-actions GitHub Actions
Copy link

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

  • The Plugin and Theme Directories cannot be accessed within Playground.
  • All changes will be lost when closing a tab with a Playground instance.
  • All changes will be lost when refreshing the page.
  • A fresh instance is created each time the link below is clicked.
  • Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
    it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@johnbillion