up vote 1 down vote favorite
share [g+] share [fb]

I want to keep a check if the user has a particular password, so I have been trying it with wp_check_password but the account for which it is checked gets logged out and can't login again till there is a call of wp_check_password in the code.

Digging into the code, I found out that it sets the password by using the new hash. and moreover if I am using wp_check_password( 'hello', md5('hello'), 1 );, it doesn't even check what is inside the database and returns true. Isn't that a bug?

Any ideas how can I check the user's password?

link|improve this question
67% accept rate
feedback

2 Answers

up vote 5 down vote accepted

Your example works correctly. You are checking if password hello matches hashed hello - which it naturally does.

Hadn't thought it through. Your example causes following issue:

  1. You check if hello matches md5 of hello (instead of hash from user's profile).
  2. It does and then WP thinks this is correct, but outdated md5 hash - that must be updated.
  3. It re-hashes hello and updates user with it, locking him out (since his password is now hello instead of whatever it was before).

See wp_authenticate_username_password() function for extensive example, but basic idea is:

$userdata = get_user_by('login', $username);
$result = wp_check_password($password, $userdata->user_pass, $userdata->ID);
link|improve this answer
But it doesn't match in all circumstances, which is what I assumed the problem was. For one the password hash function is pluggable, so its not necessarily using md5 (actually, I don't think it is by default - the default is phpass). – goldenapples Mar 30 '11 at 20:45
@goldenapples it doesn't make sense to override wp_hash_password() and leave wp_check_password(). Hash mismatch simply won't allow anyone to pass the check, no? :) – Rarst♦ Mar 30 '11 at 20:49
Oh, you're right. wp_check_password() will work the way you were using it in your answer. I was referring to his original question, checking 'hello' against the md5 of 'hello', which will fail unless md5 is the algorithm actually being used in wp_hash_password... – goldenapples Mar 30 '11 at 20:55
@goldenapples native wp_hash_password() does support md5 for backwards compatibility, it re-hashes such passwords on check. Now that I think about it this is likely the issue in original question... – Rarst♦ Mar 30 '11 at 21:03
Yeah, if the two passwords given match using md5, wp_check_password will reset the user's password using the current hashing function. So in the original question, since the two passwords given matched, it was changing the user's password to "hello"... – goldenapples Mar 30 '11 at 21:05
show 5 more comments
feedback
up vote 1 down vote

You can grab their hashed password from the database, and compare it to the entry you want to check using wp_hash_password().

To check if the current user's password matches "hello", try this:

if ( $current_user->user_pass == wp_hash_password( 'hello' ) )
link|improve this answer
if ( wp_hash_password( $xx_new_password ) != $xx_userinfo->user_pass ) works differently than if ( !wp_check_password( $xx_new_password, $xx_userinfo->user_pass , $xx_id ) ) Weird! Thanks for helping! – Ashfame Mar 30 '11 at 21:10
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.