Credits API: update sha256 hashing algorithm

[haozi]

WP core will update to use sha256 as algorithm in ​https://core.trac.wordpress.org/ticket/60638

I found that the Credits API still uses MD5, and this ticket request updates them to sha256.

[haozi]

I think there is no compatibility problem with using sha256 directly. The credits page is compatible with sha256 (just the parameters look a bit strange)

[SergeyBiryukov]

Hi there, thanks for the ticket and the patch!

At a glance, we might need to only return SHA-256 URLs for WordPress 6.8-alpha or later (as per ​[WP59532]), and still return MD5 URLs for older WP versions.

[dd32]

The patch as-is won't work either for cases where we've stored md5's in the credits file.

From looking at the core handler, we can probably just return a md5 as-is without anything special.. Something like 7860.diff​ that I haven't yet tested.

[dd32]

Replying to SergeyBiryukov:

At a glance, we might need to only return SHA-256 URLs for WordPress 6.8-alpha or later (as per ​[WP59532]), and still return MD5 URLs for older WP versions.

Turns out we don't need this at all, we can just return a sha256 I believe and core will treat it as an md5, which will pass straight through to Gravatar.

7860.2.diff​ so it's much simpler, similar to the original patch here, but a little cleaner.

[haozi]

Yes, and returning SHA-256 URLs uniformly can prevent hackers from passing a low version number to get MD5 URLs.

[dd32]

can prevent hackers from passing a low version number to get MD5 URLs.

To be fair; Sha256 rainbow tables do exist, this is not a massive security change per-se.

[dd32]

In 14307:

API: Credits: Return credits with SHA256 hashes.

Props haozi, SergeyBiryukov, dd32.
Closes ​https://github.com/WordPress/wordpress.org/pull/454.
Fixes #7860.