Code

#21022 Full bcrypt PR#8020

Code

Draft

johnbillion wants to merge 61 commits intoWordPress:trunkWordPress/wordpress-develop:trunkfrom johnbillion:21022-bcrypt-algo-filterjohnbillion/wordpress-develop:21022-bcrypt-algo-filterCopy head branch name to clipboard

+1,165-146

Commits

Commits on Sep 11, 2024

• Begin switching the password hashing mechanism from phpass to bcrypt.

  johnbillion

  committed
  fe1c16e

• Update the handling of user passwords, password reset keys, and user request keys.

  johnbillion

  committed
  82d937f

• Update the handling of the recovery mode key.

  johnbillion

  committed
  f12e93d

• Update the handling of post passwords.

  johnbillion

  committed
  5a46809

• Automatically rehash user passwords and application passwords after they are validated.

  johnbillion

  committed
  d4e4e47

• Docs.

  johnbillion

  committed
  638421d

• Juggle this a bit.

  johnbillion

  committed
  316cb41

• Trying to get these tests in order.

  johnbillion

  committed
  76fa518

• More docs.

  johnbillion

  committed
  d707939

• Retain validity of phpass hashed password reset keys.

  johnbillion

  committed
  4a796b7

• Retain validity of a phpass hashed recovery mode key.

  johnbillion

  committed
  64dfd57

• Retain validity of phpass hashed user request keys.

  johnbillion

  committed
  e161994

• More docs.

  johnbillion

  committed
  548f937

Commits on Sep 12, 2024

• Add tests for password rehashing when signing in with a username or email address.

  johnbillion

  committed
  fe9b053

• Docs.

  johnbillion

  committed
  33cf000

• Ensure wp_check_password() remains compatible with changes to the default bcrypt cost.

  johnbillion

  committed
  d51cbc2

• Simplify this logic.

  johnbillion

  committed
  6b5441c

• Add tests for Argon2 support.

  johnbillion

  committed
  89e0645

• Always pass the return value of wp_check_password() through the check_password filter.

  johnbillion

  committed
  085b73c

• Reintroduce support for the $wp_hasher global if it's set.

  johnbillion

  committed
  3e078a7

• Test the tests.

  johnbillion

  committed
  be636be

• Docs.

  johnbillion

  committed
  4265787

• Start splitting up and fixing these tests.

  johnbillion

  committed
  fd6bcdd

• Coding standards.

  johnbillion

  committed
  392e612

Commits on Sep 13, 2024

• Add a todo.

  johnbillion

  committed
  9040193

Commits on Sep 17, 2024

• Add some more assertions to the application password auth tests.

  johnbillion

  committed
  bc99ca1

• Correct and add tests for the application password rehashing.

  johnbillion

  committed
  58a89e2

• Done.

  johnbillion

  committed
  49871d0

• Coding standards.

  johnbillion

  committed
  b42e57b

• Allow either the name or password to change in order to allow an application password to get updated.

  johnbillion

  committed
  2baeb19

• Docs.

  johnbillion

  committed
  95f6d94

Commits on Oct 8, 2024

• PHP 7.2 compatibility.

  johnbillion

  committed
  f8974eb

• Docs.

  johnbillion

  committed
  ff85df2

• Add a test to ensure the user's account password isn't touched when rehashing an application password.

  johnbillion

  committed
  ebcdd26

• Merge branch 'trunk' into 21022-bcrypt

  johnbillion

  committed
  140b9d4

• One fewer regexes in the world.

  johnbillion

  committed
  ea8c56c

Commits on Oct 9, 2024

• Merge branch 'trunk' into 21022-bcrypt

  johnbillion

  committed
  2ef2077

Commits on Oct 11, 2024

• Allow the password hashing options to be filtered.

  johnbillion

  committed
  3a951ef

• Docs.

  johnbillion

  committed
  53acf70

Commits on Oct 21, 2024

• Merge branch 'trunk' into 21022-bcrypt

  johnbillion

  committed
  5944d9a

• Cease hashing passwords as md5 during the upgrade routine and/or the repair routine.

  Show description for 820f48f
  johnbillion

  committed
  820f48f

• More tests for empty values.

  johnbillion

  committed
  c07e618

• More updates to the tests.

  johnbillion

  committed
  5d33621

Commits on Oct 22, 2024

• Add a test to verify that a password gets rehashed when the default cost is increased.

  johnbillion

  committed
  0063154

• This might as well go here.

  johnbillion

  committed
  1aea250

• Add tests for post password handling.

  johnbillion

  committed
  d6c7837

• Merge branch 'trunk' into 21022-bcrypt

  johnbillion

  committed
  8b1dbd2

• Clear the cookie value before performing the assertions.

  johnbillion

  committed
  5824f4c

Commits on Nov 5, 2024

• Implement pre-hashing with sha384 to retain entropy of passwords over 72 bytes.

  johnbillion

  committed
  2502179

Commits on Nov 11, 2024

• Implement domain separation for the password to protect against password shucking.

  johnbillion

  committed
  2321412

Commits on Nov 25, 2024

• Remove assertions that are unnecessarily specific to bcrypt.

  johnbillion

  committed
  d86ef6d

• The default bcrypt cost was increased in PHP 8.4.

  johnbillion

  committed
  09ddc5e

Commits on Dec 12, 2024

• Merge branch 'trunk' into 21022-bcrypt-sha2

  johnbillion

  committed
  a27411d

• Merge branch 'trunk' into 21022-bcrypt

  johnbillion

  committed
  e5f8d5c

• Merge branch '21022-bcrypt' into 21022-bcrypt-sha2

  Show description for 9bb86a8
  johnbillion

  committed
  9bb86a8

• Switch to HMAC in place of manually prepending the domain separation key.

  johnbillion

  committed
  1cebd80

Commits on Dec 18, 2024

• Introduce the wp_hash_password_algorithm filter for controlling the password hashing algorithm.

  johnbillion

  committed
  537ee4a

• Why.

  johnbillion

  committed
  8a99edd

• Vanilla bcrypt hashes should be rehashed to use pre-hashing.

  johnbillion

  committed
  68634f0

• Let's bring this more inline with the other tests.

  johnbillion

  committed
  adf983f

• No need to perform a prefix check here, just let wp_check_password() handle everything.

  johnbillion

  committed
  754519b