!IMPORTANT: Old bug about LOGIN FAIL on WP discovered: just resolved on patched 1.5.7

Post a reply


This question is a means of preventing automated form submissions by spambots.
Smilies
:D :) ;) :( :o :shock: :? 8-) :lol: :x :P :oops: :cry: :evil: :twisted: :roll: :!: :?: :idea: :arrow: :| :mrgreen: :geek: :ugeek:

BBCode is ON
[img] is ON
[url] is ON
Smilies are ON

Topic review
   

If you wish to attach one or more files enter the details below.

Maximum filesize per attachment: 1 MiB.

Expand view Topic review: !IMPORTANT: Old bug about LOGIN FAIL on WP discovered: just resolved on patched 1.5.7

!IMPORTANT: Old bug about LOGIN FAIL on WP discovered: just resolved on patched 1.5.7

by axew3 » Thu Jan 12, 2017 11:11 pm

Has been just resolved a bug that was coming out on some servers, and not on many others (or maybe the contrary). It is an important bug resolved.

It was the password that if was not properly escaped, and containing special chars inside, was leading to the user login failure on some servers and not others. I've finally encounter this big bug into a CentOS server. It have for sure cause fail installations for many users, and all reported problems about WP login fail after plugin install.

Finally all the mess have been resolved with just this:

file wp_w3all.php
search for code:

Code: Select all

$check = $wp_hasher->CheckPassword($password, $hash);
replace with:

Code: Select all

$password = esc_attr($password);
$check = $wp_hasher->CheckPassword($password, $hash);
The WP_w3all 1.5.7 wp_w3all.php file has been updated on repo, while 1.5.8 is coming.

Top