0

I get the following error when trying to login:

Error: Cookies are blocked due to unexpected output.
enter image description here

I customized the wordpress core functions wp_hash_password() and wp_check_password() to use SHA1 algorithm for user authentification instead of MD5. I modified them in the pluggable.php file (not best practice but good for testing). The functions now look like this:

function wp_hash_password( $password ) {
            global $wp_hasher;

            if ( empty( $wp_hasher ) ) {
                    $wp_hasher = sha1( $password );
            }

            return $wp_hasher->HashPassword( trim( $password ) );;
    }


function wp_check_password( $password, $hash, $user_id = '' ) {
            global $wp_hasher;
            // If the hash is still md5...
            if ( strlen( $hash ) == 40 ) {
                    echo '<h2>'.$hash.'</h2>';
                    $check = hash_equals( $hash, sha1( $password ) );
                    if ( $check && $user_id ) {
                            // Rehash using new hash.
                            wp_set_password( $password, $user_id );
                            $hash = wp_hash_password( $password );
                    }

                    /**
                     * Filters whether the plaintext password matches the encrypted password.
                     *
                     * @since 2.5.0
                     *
                     * @param bool       $check    Whether the passwords match.
                     * @param string     $password The plaintext password.
                     * @param string     $hash     The hashed password.
                     * @param string|int $user_id  User ID. Can be empty.
                     */
                    return apply_filters( 'check_password', $check, $password, $hash, $user_id );
            }

            // If the stored hash is longer than an MD5,
            // presume the new style phpass portable hash.
            if ( empty( $wp_hasher ) ) {
                    require_once ABSPATH . WPINC . '/class-phpass.php';
                    // By default, use the portable hash from phpass.
                    $wp_hasher = new PasswordHash( 8, true );
            }

            $check = $wp_hasher->CheckPassword( $password, $hash );

            /** This filter is documented in wp-includes/pluggable.php */
            return apply_filters( 'check_password', $check, $password, $hash, $user_id );
    }

The conversion from password to SHA1 works perfectly aswell as the password check. I think a function responsible for setting the cookie is still using MD5. But I can't verify and can't find the function.
Does anyone has an idea on this?

Thanks in advance
Jan

Improve this question
2
  • Note that if your PHP environment supports it, blowfish and extended DES are available via the password hash class you removed. There is no need to do this if you want to move away from MD5. It could be argued that what you have here is less secure than core, not more
    – Tom J Nowell ♦
    Commented Feb 24, 2021 at 23:33
  • Also your wp_hash_password function has a bug, sha1 returns a string, not an object. SHA1 also has the same problems MD5 does, attacks on the SHA1 hash algorithm have been known for ~15 years now
    – Tom J Nowell ♦
    Commented Feb 24, 2021 at 23:39

1 Answer 1

Reset to default
0

This line (at least) is being output before the cookie can be set:

echo '<h2>'.$hash.'</h2>';

Sending output to the screen (even empty lines) will prevent cookies being set.

From the PHP docs:

Like other headers, cookies must be sent before any output from your script (this is a protocol restriction). This requires that you place calls to this function prior to any output, including <html> and <head> tags as well as any whitespace.

Improve this answer
1
  • That worked, thank you! Is there a way to debug without using echo?
    – Jan
    Commented Feb 24, 2021 at 23:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.