3

So we are using a couple of custom things in our WP and one of them is a PW-Recovery form. Using this internally we're setting the password with

wp_set_password($password, $userId)

Lately we realised a problem with passwords containing the apostrophe character "

Setting a password with this will leave the user unable to log in using the same password that was just set. We have applied nothing to the login process and I can verify that the correct password is entered into the wp_set_password() function as well as the login form.

Any pointers as to where I can look for potential errors would be great. Thank you for your time.

Update 1

Using wp_signon() the user is able to login using the password Test"123

Using wp-login.php?page=login and entering the password Test"123 will not work

currently looking for all the filters that could potentionally interfere with this...

Update 2

Looks to me like an undocumented wordpress feature / bug?

All plugins have been deactivated. The unmodified theme twentefifteen has been used. Changing the password using wp_set_password() changes the PW in the database. However using a password with " or ' will result you being unable to login using wp-login.php. It will give you invalid credentials error.

However using the same login data and wp_signon() it works. I'm just clueless, probably forwarding to wp bug forums.

Update 3

I am using this plugin snipped to reset and test the login.

function resetLogin() {
//    wp_set_password('Test"123', 1);
    wp_update_user([
        'ID' => 1,
        'user_pass' => 'Test"123'
    ]);
}
//add_action('after_setup_theme', 'resetLogin');

function testLogin() {
    var_dump(wp_signon([
        'user_login' => 'admin',
        'user_password' => 'Test"123',
        'remember' => true
    ], false));
}
//add_action('after_setup_theme', 'testLogin');

To test I am commenting in the add_action - resetLogin once, and deactivate it immediately again before doing anything on the page. This then immediately breaks the login on wp-login.php

  • 1
    You are getting incorrect password message or what happens when a user can't log in? – ThemesCreator Oct 14 '15 at 10:03
  • @ThemesCreator correct, sorry for not being explicit enough. Please see the second update. I can only imagine this being a bug. – Sam Oct 14 '15 at 10:05
  • 1
    I've been trying with default WordPress form to generate new password and it works perfectly with " and ' characters. It must be something you are doing wrong. Can you show the full code you are using? – cybmeta Oct 14 '15 at 10:33
  • @cybmeta the problem clearly lies within the usage of wp_set_password() and/or wp_update_user() - I just ran my test snipped on a naked wordpress installation. (snipped see update 3) – Sam Oct 14 '15 at 11:01
  • 1
    @cybmeta Just to ping you again - the issue was that those functions require wp_slash() to be used. This however isn't documented, but will surely be added as now there is an open ticket for it :) – Sam Oct 14 '15 at 11:38
6

The resolution is pretty simply. Those functions require the passwords to be properly escaped. So

Instead of this:

wp_set_password('Test"123', $userId);

You have to do this:

wp_set_password(wp_slash('Test"123'), $userId);

The same goes for wp_update_user() and wp_signon(). Further information and updates on the docs may be visible from this bug report:

  • Upvote for answering your own question – cybmeta Oct 14 '15 at 12:57
  • 2
    WTF wordpress. That makes no sense what-so-ever. It's the wrong abstraction level to handle sql escaping and passwords aren't even stored in the database directly. – CodesInChaos Oct 14 '15 at 13:11
  • @CodesInChaos I think this goes way back to the time of magic quotes. Wordpress still does "addslashes" to every single $_POST and get variable there is. Knowing a little bit of Wordpress's internals doing this is pretty obvious - though getting to the point of realization cost me 6 hours of work Xx for a freaking addslashes.... Xx – Sam Oct 14 '15 at 18:44
1

I am not sure if this exactly what is happening to you, but this is what the codex says about wp_set_password():

Please note: This function should be used sparingly and is really only meant for single-time application. Leveraging this improperly in a plugin or theme could result in an endless loop of password resets if precautions are not taken to ensure it does not execute on every page load.

https://developer.wordpress.org/reference/functions/wp_set_password/

I think you should only use it to reset the password and then delete it.

  • I am aware of this, thank you. I am using it the way it is meant to be. As far as I can tell there is two ways to update a users password. wp_set_password() and wp_update_user() - both ultimately result in the same outcome :( – Sam Oct 14 '15 at 10:23
  • Just to ping you again - the issue was that those functions require wp_slash() to be used. This however isn't documented, but will surely be added as now there is an open ticket for it :) – Sam Oct 14 '15 at 11:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.