Changeset 14307

Timestamp:

12/18/2024 03:14:25 AM (5 months ago)

Author:

dd32

Message:

API: Credits: Return credits with SHA256 hashes.

Props haozi, SergeyBiryukov, dd32.
Closes ​https://github.com/WordPress/wordpress.org/pull/454.
Fixes #7860.

File:

• sites/trunk/api.wordpress.org/public_html/core/credits/wp-credits.php (modified) (7 diffs)

sites/trunk/api.wordpress.org/public_html/core/credits/wp-credits.php

@@ -222 +222 @@
                 continue;
             if ( $user->display_name && $user->display_name != $user->user_nicename && false === strpos( $user->display_name , '?') )
-                $validators[ $user->user_nicename ] = array( $this->_encode( $user->display_name ), md5( $user->user_email ), $user->user_nicename );
+                $validators[ $user->user_nicename ] = array( $this->_encode( $user->display_name ), $this->hash( $user->user_email ), $user->user_nicename );
             else
-                $validators[ $user->user_nicename ] = array( $user->user_nicename, md5( $user->user_email ), $user->user_nicename );
+                $validators[ $user->user_nicename ] = array( $user->user_nicename, $this->hash( $user->user_email ), $user->user_nicename );
         }
 
@@ -300 +300 @@
 
                 if ( ! empty( $person[2] ) ) {
-                    // array( 'Andrew Nacin', 'Lead Developer', 'md5 hash' )
+                    // array( 'Andrew Nacin', 'Lead Developer', 'gravatar hash' )
                     $new_data['title'] = $person[1];
                     $new_data['hash'] = $person[2];
@@ -306 +306 @@
                     // array( 'Andrew Nacin' )
                     $fetch_emails_from_user_cache[ $k ] = $group_slug;
-                } elseif ( strlen( $person[1] ) === 32 && preg_match('/^[a-f0-9]{32}$/', $person[1] ) ) {
-                    // array( 'Andrew Nacin', 'md5 hash' )
+                } elseif ( $this->is_hashed( $person[1] ) ) {
+                    // array( 'Andrew Nacin', 'gravatar hash' )
                     $new_data['hash'] = $person[1];
                 } else {
@@ -316 +316 @@
 
                 // Temporary:
-                if ( strlen( $new_data['hash'] ) != 32 || strpos( $new_data['hash'], '@' ) ) {
-                    $new_data['hash'] = md5( $new_data['hash'] );
+                if ( ! $this->is_hashed( $new_data['hash'] ) ) {
+                    $new_data['hash'] = $this->hash( $new_data['hash'] );
                 }
 
@@ -331 +331 @@
                 if ( $user_id ) {
                     if ( $user_object = wp_cache_get( $user_id, 'users' ) ) {
-                        $groups[ $group ]['data'][ $username ][1] = md5( strtolower( $user_object->user_email ) );
+                        $groups[ $group ]['data'][ $username ][1] = $this->hash( $user_object->user_email );
                     } else {
                         $fetch_emails_from_db[ $username ] = $group;
@@ -342 +342 @@
                 $fetched = $wpdb->get_results( "SELECT user_login, ID, user_email FROM $wpdb->users WHERE user_login IN ('" . implode( "', '", array_keys( $fetch_emails_from_db ) ) . "')", OBJECT_K );
                 foreach ( $fetched as $username => $row ) {
-                    $groups[ $fetch_emails_from_db[ $username ] ]['data'][ $username ][1] = md5( strtolower( $row->user_email ) );
+                    $groups[ $fetch_emails_from_db[ $username ] ]['data'][ $username ][1] = $this->hash( $row->user_email );
                     wp_cache_add( $username, $row->ID, 'userlogins' );
                 }
@@ -446 +446 @@
     }
 
+    private function is_hashed( $maybe_hash ) {
+        if (
+            ! is_string( $maybe_hash ) ||
+            strpos( $maybe_hash, '@' ) !== false
+        ) {
+            return false;
+        }
+
+        switch ( strlen( $maybe_hash ) ) {
+            case 32:
+                return preg_match( '/^[a-f0-9]{32}$/', $maybe_hash );
+            case 64:
+                return preg_match( '/^[a-f0-9]{64}$/', $maybe_hash );
+        }
+
+        return false;
+    }
+
+    private function hash( $email ) {
+        return hash( 'sha256', strtolower( $email ) );
+    }
+
 }