Changeset 14307

Timestamp:

12/18/2024 03:14:25 AM (20 months ago)

Author:

dd32

Message:

API: Credits: Return credits with SHA256 hashes.

Props haozi, SergeyBiryukov, dd32.
Closes ​https://github.com/WordPress/wordpress.org/pull/454.
Fixes #7860.

File:

• sites/trunk/api.wordpress.org/public_html/core/credits/wp-credits.php (modified) (7 diffs)

sites/trunk/api.wordpress.org/public_html/core/credits/wp-credits.php

@@ -222 +222 @@
                                 continue;
                         if ( $user->display_name && $user->display_name != $user->user_nicename && false === strpos( $user->display_name , '?') )
-                                $validators[ $user->user_nicename ] = array( $this->_encode( $user->display_name ), md5( $user->user_email ), $user->user_nicename );
+                                $validators[ $user->user_nicename ] = array( $this->_encode( $user->display_name ), $this->hash( $user->user_email ), $user->user_nicename );
                         else
-                                $validators[ $user->user_nicename ] = array( $user->user_nicename, md5( $user->user_email ), $user->user_nicename );
+                                $validators[ $user->user_nicename ] = array( $user->user_nicename, $this->hash( $user->user_email ), $user->user_nicename );
                 }
 
@@ -300 +300 @@
 
                                 if ( ! empty( $person[2] ) ) {
-                                        // array( 'Andrew Nacin', 'Lead Developer', 'md5 hash' )
+                                        // array( 'Andrew Nacin', 'Lead Developer', 'gravatar hash' )
                                         $new_data['title'] = $person[1];
                                         $new_data['hash'] = $person[2];
@@ -306 +306 @@
                                         // array( 'Andrew Nacin' )
                                         $fetch_emails_from_user_cache[ $k ] = $group_slug;
-                                } elseif ( strlen( $person[1] ) === 32 && preg_match('/^[a-f0-9]{32}$/', $person[1] ) ) {
-                                        // array( 'Andrew Nacin', 'md5 hash' )
+                                } elseif ( $this->is_hashed( $person[1] ) ) {
+                                        // array( 'Andrew Nacin', 'gravatar hash' )
                                         $new_data['hash'] = $person[1];
                                 } else {
@@ -316 +316 @@
 
                                 // Temporary:
-                                if ( strlen( $new_data['hash'] ) != 32 || strpos( $new_data['hash'], '@' ) ) {
-                                        $new_data['hash'] = md5( $new_data['hash'] );
+                                if ( ! $this->is_hashed( $new_data['hash'] ) ) {
+                                        $new_data['hash'] = $this->hash( $new_data['hash'] );
                                 }
 
@@ -331 +331 @@
                                 if ( $user_id ) {
                                         if ( $user_object = wp_cache_get( $user_id, 'users' ) ) {
-                                                $groups[ $group ]['data'][ $username ][1] = md5( strtolower( $user_object->user_email ) );
+                                                $groups[ $group ]['data'][ $username ][1] = $this->hash( $user_object->user_email );
                                         } else {
                                                 $fetch_emails_from_db[ $username ] = $group;
@@ -342 +342 @@
                                 $fetched = $wpdb->get_results( "SELECT user_login, ID, user_email FROM $wpdb->users WHERE user_login IN ('" . implode( "', '", array_keys( $fetch_emails_from_db ) ) . "')", OBJECT_K );
                                 foreach ( $fetched as $username => $row ) {
-                                        $groups[ $fetch_emails_from_db[ $username ] ]['data'][ $username ][1] = md5( strtolower( $row->user_email ) );
+                                        $groups[ $fetch_emails_from_db[ $username ] ]['data'][ $username ][1] = $this->hash( $row->user_email );
                                         wp_cache_add( $username, $row->ID, 'userlogins' );
                                 }
@@ -446 +446 @@
         }
 
+        private function is_hashed( $maybe_hash ) {
+                if (
+                        ! is_string( $maybe_hash ) ||
+                        strpos( $maybe_hash, '@' ) !== false
+                ) {
+                        return false;
+                }
+
+                switch ( strlen( $maybe_hash ) ) {
+                        case 32:
+                                return preg_match( '/^[a-f0-9]{32}$/', $maybe_hash );
+                        case 64:
+                                return preg_match( '/^[a-f0-9]{64}$/', $maybe_hash );
+                }
+
+                return false;
+        }
+
+        private function hash( $email ) {
+                return hash( 'sha256', strtolower( $email ) );
+        }
+
 }