Password Hashing / Login Problem Hacking WordPress Forum

The support forums have a new home! Please visit All in One SEO Pack's new residence at Semper Plugins to purchase a support plan.

Please consider registering
guest

Log In

Lost password?
Advanced Search:

— Forum Scope —



— Match —



— Forum Options —




Wildcard usage:
*  matches any number of characters    %  matches exactly one character

Minimum search word length is 4 characters - maximum search word length is 84 characters

Topic RSS
Password Hashing / Login Problem
September 22, 2009
1:02 am
tregenza
New Member
Forum Posts: 1
Member Since:
September 22, 2009
Offline

I've made a custom user registration and login screen for a plugin that I'm making and it all seems to work ok. The user gets created and is assigned a randomly generated password.

The problem I'm having is when somewhere along the way, the login process (the default Wordpress wp-login.php) rejects the password.

I started tracing around the programming code, and it looks like the hashing of the password which gets stored in the database is for some reason different from hash that is created when the password entered in the login screen.

This suggests the bug is in how I hash & store the password during user creation but the code looks right and relies on standard WP functions.

Can anyone offer any suggestions.

/** Adds the user to the Wordpress system
* It is a cut down version wp-includes/registration.php wp_insert_user
*/
private function createUser( $user_login, $password, $user_email) {
global $wpdb;

$user_login = esc_html( trim( $user_login ));
$user_email = esc_html( trim( $user_email ));

$update = false;

// Hash the password
$user_pass = wp_hash_password($password);

$user_login = sanitize_user($user_login, true);
$user_login = apply_filters('pre_user_login', $user_login);

$user_email = apply_filters('pre_user_email', $user_email);

$rich_editing = 'true';
$comment_shortcuts = 'false';
$admin_color = 'fresh';
$admin_color = preg_replace('|[^a-z0-9 _.\-@]|i', '', $admin_color);
$use_ssl = 0;
$user_registered = gmdate('Y-m-d H:i:s');

$data = compact( 'user_pass', 'user_email', 'user_registered' );
$data = stripslashes_deep( $data );

$wpdb->insert( $wpdb->users, $data + compact( 'user_login' ) );
$user_id = (int) $wpdb->insert_id;

update_usermeta( $user_id, 'rich_editing', $rich_editing);
update_usermeta( $user_id, 'comment_shortcuts', $comment_shortcuts);
update_usermeta( $user_id, 'admin_color', $admin_color);
update_usermeta( $user_id, 'use_ssl', $use_ssl);

$user = new WP_User($user_id);
$user->set_role(TACS_AFFILIATE_ROLE);

wp_cache_delete($user_id, 'users');
wp_cache_delete($user_login, 'userlogins');

do_action('user_register', $user_id);

return $user_id;
}

Example:

Plain text password passed to the code above:
wWFNJ5WVItDj

Stored password, hashed by the code above: $P$Bux0eEtTqlP/PYoyVRgNYnudssLFhd/

What wp-login via class-phpass.php -> CheckPassword thinks the hash of the plain text password should be:
$P$Bux0eEtTq78PqC77J2i4LFT.ggSDa81

As the two hashes are different, the login process fails but I cannot see why this difference exists.

What am I missing?

May 26, 2011
12:14 pm
seogenius
New Member
Forum Posts: 10
Member Since:
May 26, 2011
Offline
Forum Timezone: America/New_York

Most Users Ever Online: 205

Currently Online:
32 Guest(s)

Currently Browsing this Page:
2 Guest(s)

Top Posters:

romiojuliat: 102

yaoming987: 50

jintuy: 50

miki1986: 33

newshow: 28

karen1234: 27

Member Stats:

Guest Posters: 0

Members: 6356

Moderators: 3

Admins: 4

Forum Stats:

Groups: 5

Forums: 23

Topics: 1546

Posts: 3450

Newest Members: carofern@cisco.com, pronto, jessie, pbaylies, ninaeast, freda

Moderators: davecashmore (2), aaron (5), tempadmin (0)

Administrators: WordPress Professional (442), hallsofmontezuma (202), onefinejay (10), stevemortiboy (4)