Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I want to keep a check if the user has a particular password, so I have been trying it with wp_check_password but the account for which it is checked gets logged out and can't login again till there is a call of wp_check_password in the code.

Digging into the code, I found out that it sets the password by using the new hash. and moreover if I am using wp_check_password( 'hello', md5('hello'), 1 );, it doesn't even check what is inside the database and returns true. Isn't that a bug?

Any ideas how can I check the user's password?

share|improve this question
add comment

2 Answers

up vote 5 down vote accepted

Your example works correctly. You are checking if password hello matches hashed hello - which it naturally does.

Hadn't thought it through. Your example causes following issue:

  1. You check if hello matches md5 of hello (instead of hash from user's profile).
  2. It does and then WP thinks this is correct, but outdated md5 hash - that must be updated.
  3. It re-hashes hello and updates user with it, locking him out (since his password is now hello instead of whatever it was before).

See wp_authenticate_username_password() function for extensive example, but basic idea is:

$userdata = get_user_by('login', $username);
$result = wp_check_password($password, $userdata->user_pass, $userdata->ID);
share|improve this answer
    
But it doesn't match in all circumstances, which is what I assumed the problem was. For one the password hash function is pluggable, so its not necessarily using md5 (actually, I don't think it is by default - the default is phpass). –  goldenapples Mar 30 '11 at 20:45
    
@goldenapples it doesn't make sense to override wp_hash_password() and leave wp_check_password(). Hash mismatch simply won't allow anyone to pass the check, no? :) –  Rarst Mar 30 '11 at 20:49
    
Oh, you're right. wp_check_password() will work the way you were using it in your answer. I was referring to his original question, checking 'hello' against the md5 of 'hello', which will fail unless md5 is the algorithm actually being used in wp_hash_password... –  goldenapples Mar 30 '11 at 20:55
    
@goldenapples native wp_hash_password() does support md5 for backwards compatibility, it re-hashes such passwords on check. Now that I think about it this is likely the issue in original question... –  Rarst Mar 30 '11 at 21:03
    
Yeah, if the two passwords given match using md5, wp_check_password will reset the user's password using the current hashing function. So in the original question, since the two passwords given matched, it was changing the user's password to "hello"... –  goldenapples Mar 30 '11 at 21:05
show 5 more comments

You can grab their hashed password from the database, and compare it to the entry you want to check using wp_hash_password().

To check if the current user's password matches "hello", try this:

if ( $current_user->user_pass == wp_hash_password( 'hello' ) )
share|improve this answer
    
if ( wp_hash_password( $xx_new_password ) != $xx_userinfo->user_pass ) works differently than if ( !wp_check_password( $xx_new_password, $xx_userinfo->user_pass , $xx_id ) ) Weird! Thanks for helping! –  Ashfame Mar 30 '11 at 21:10
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.