Pluggable function changing password encryption

  • Resolved Daniel Chase

    (@riseofweb)


    10 years, 8 months ago

    I have created a simple plugin (yes, it is activated). The plugin contains:

    <?php
    /**
     * Plugin Name: Password Encryption
     * Description: Password Encryption
     */

    if ( !function_exists('wp_set_password') ){
    	function wp_set_password( $password, $user_id ) {
    		global $wpdb;
    		$enc = mcrypt_encrypt(MCRYPT_RIJNDAEL_128,'ABC',$password,MCRYPT_MODE_CBC,'XYZ');
    		$r = base64_encode($enc);
    		$wpdb->update($wpdb->users, array('user_pass' => $r, 'user_activation_key' => ''), array('ID' => $user_id) );
    		wp_cache_delete($user_id, 'users');
    	}
    }

    if ( !function_exists('wp_check_password') ){
    	function wp_check_password($password, $hash, $user_id = '') {
    		if ( $user_id ) {
    			wp_set_password($password, $user_id);
    			//$hash = wp_hash_password($password);
    			$hash = '';
    			$r = base64_decode($password);
    			$hash = mcrypt_decrypt(MCRYPT_RIJNDAEL_128,'ABC',$r,MCRYPT_MODE_CBC,'XYZ');
    		}
    		return apply_filters( 'check_password', false, $password, $hash, $user_id );
    	}
    }

    My problem is my plugin has no effect on the password encryption, these 2 functions are in the wp-includes/pluggable.php, so I thought this would overwrite them. Am I missing something? Is there a better or easier way to do this?

    Thanks.

Viewing 1 replies (of 1 total)
  • Thread Starter Daniel Chase

    (@riseofweb)

    10 years, 8 months ago

    I figured it out. I needed to change the wp_check_password and wp_hash_password functions. Here is my solution.

    <?php
/**
 * Plugin Name: Password Encryption
 * Description: Password Encryption
 */

if ( !function_exists('wp_hash_password') ){

	function wp_hash_password($password) {
		$enc = mcrypt_encrypt(MCRYPT_RIJNDAEL_128,'ABC',$password,MCRYPT_MODE_CBC,'XYZ');
		$r = base64_encode($enc);
		return trim($r);
	}
}

if ( !function_exists('wp_check_password') ){
	function wp_check_password($password, $hash, $user_id = '') {
		global $wp_hasher;
		$check = false;
		if ( $user_id ) {
			$test = wp_hash_password($password);
		}
		if($test == $hash ){
			$check = true;
		}
		return apply_filters( 'check_password', $check, $password, $hash, $user_id );
	}
}

?>

    Super easy to change the encryption once I really read through the WordPress functions.

Viewing 1 replies (of 1 total)

The topic ‘Pluggable function changing password encryption’ is closed to new replies.