<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[59754] trunk/src: Security: Add the `SensitiveParameter` attribute to sensitive parameters.</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { white-space: pre-line; overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta" style="font-size: 105%">
<dt style="float: left; width: 6em; font-weight: bold">Revision</dt> <dd><a style="font-weight: bold" href="https://core.trac.wordpress.org/changeset/59754">59754</a><script type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","description":"Review this Commit","action":{"@type":"ViewAction","url":"https://core.trac.wordpress.org/changeset/59754","name":"Review Commit"}}</script></dd>
<dt style="float: left; width: 6em; font-weight: bold">Author</dt> <dd>johnbillion</dd>
<dt style="float: left; width: 6em; font-weight: bold">Date</dt> <dd>2025-02-03 19:50:50 +0000 (Mon, 03 Feb 2025)</dd>
</dl>
<pre style='padding-left: 1em; margin: 2em 0; border-left: 2px solid #ccc; line-height: 1.25; font-size: 105%; font-family: sans-serif'>Security: Add the `SensitiveParameter` attribute to sensitive parameters.
Values passed to parameters with this attribute will be redacted if present in a stack trace when using PHP 8.2 or later. This reduces the chance that passwords and security keys get accidentally exposed in debug logs and bug reports.
Props petitphp, TobiasBg, jrf, johnbillion.
Fixes <a href="https://core.trac.wordpress.org/ticket/57304">#57304</a></pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunksrcwpadminincludesclasswpimporterphp">trunk/src/wp-admin/includes/class-wp-importer.php</a></li>
<li><a href="#trunksrcwpadminincludesupgradephp">trunk/src/wp-admin/includes/upgrade.php</a></li>
<li><a href="#trunksrcwpincludesclasswpapplicationpasswordsphp">trunk/src/wp-includes/class-wp-application-passwords.php</a></li>
<li><a href="#trunksrcwpincludesclasswpxmlrpcserverphp">trunk/src/wp-includes/class-wp-xmlrpc-server.php</a></li>
<li><a href="#trunksrcwpincludesclasswpdbphp">trunk/src/wp-includes/class-wpdb.php</a></li>
<li><a href="#trunksrcwpincludesmsfunctionsphp">trunk/src/wp-includes/ms-functions.php</a></li>
<li><a href="#trunksrcwpincludespluggabledeprecatedphp">trunk/src/wp-includes/pluggable-deprecated.php</a></li>
<li><a href="#trunksrcwpincludespluggablephp">trunk/src/wp-includes/pluggable.php</a></li>
<li><a href="#trunksrcwpincludesrestapiendpointsclasswprestuserscontrollerphp">trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php</a></li>
<li><a href="#trunksrcwpincludesuserphp">trunk/src/wp-includes/user.php</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunksrcwpadminincludesclasswpimporterphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/includes/class-wp-importer.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/includes/class-wp-importer.php 2025-02-03 16:53:16 UTC (rev 59753)
+++ trunk/src/wp-admin/includes/class-wp-importer.php 2025-02-03 19:50:50 UTC (rev 59754)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -195,7 +195,13 @@
</span><span class="cx" style="display: block; padding: 0 10px"> * @param bool $head
</span><span class="cx" style="display: block; padding: 0 10px"> * @return array
</span><span class="cx" style="display: block; padding: 0 10px"> */
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- public function get_page( $url, $username = '', $password = '', $head = false ) {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ public function get_page(
+ $url,
+ $username = '',
+ #[\SensitiveParameter]
+ $password = '',
+ $head = false
+ ) {
</ins><span class="cx" style="display: block; padding: 0 10px"> // Increase the timeout.
</span><span class="cx" style="display: block; padding: 0 10px"> add_filter( 'http_request_timeout', array( $this, 'bump_request_timeout' ) );
</span><span class="cx" style="display: block; padding: 0 10px">
</span></span></pre></div>
<a id="trunksrcwpadminincludesupgradephp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/includes/upgrade.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/includes/upgrade.php 2025-02-03 16:53:16 UTC (rev 59753)
+++ trunk/src/wp-admin/includes/upgrade.php 2025-02-03 19:50:50 UTC (rev 59754)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -44,7 +44,16 @@
</span><span class="cx" style="display: block; padding: 0 10px"> * @type string $password_message The explanatory message regarding the password.
</span><span class="cx" style="display: block; padding: 0 10px"> * }
</span><span class="cx" style="display: block; padding: 0 10px"> */
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- function wp_install( $blog_title, $user_name, $user_email, $is_public, $deprecated = '', $user_password = '', $language = '' ) {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ function wp_install(
+ $blog_title,
+ $user_name,
+ $user_email,
+ $is_public,
+ $deprecated = '',
+ #[\SensitiveParameter]
+ $user_password = '',
+ $language = ''
+ ) {
</ins><span class="cx" style="display: block; padding: 0 10px"> if ( ! empty( $deprecated ) ) {
</span><span class="cx" style="display: block; padding: 0 10px"> _deprecated_argument( __FUNCTION__, '2.6.0' );
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -563,7 +572,13 @@
</span><span class="cx" style="display: block; padding: 0 10px"> * @param string $password Administrator's password. Note that a placeholder message is
</span><span class="cx" style="display: block; padding: 0 10px"> * usually passed instead of the actual password.
</span><span class="cx" style="display: block; padding: 0 10px"> */
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- function wp_new_blog_notification( $blog_title, $blog_url, $user_id, $password ) {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ function wp_new_blog_notification(
+ $blog_title,
+ $blog_url,
+ $user_id,
+ #[\SensitiveParameter]
+ $password
+ ) {
</ins><span class="cx" style="display: block; padding: 0 10px"> $user = new WP_User( $user_id );
</span><span class="cx" style="display: block; padding: 0 10px"> $email = $user->user_email;
</span><span class="cx" style="display: block; padding: 0 10px"> $name = $user->user_login;
</span></span></pre></div>
<a id="trunksrcwpincludesclasswpapplicationpasswordsphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-includes/class-wp-application-passwords.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-includes/class-wp-application-passwords.php 2025-02-03 16:53:16 UTC (rev 59753)
+++ trunk/src/wp-includes/class-wp-application-passwords.php 2025-02-03 19:50:50 UTC (rev 59754)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -459,7 +459,10 @@
</span><span class="cx" style="display: block; padding: 0 10px"> * @param string $raw_password The raw application password.
</span><span class="cx" style="display: block; padding: 0 10px"> * @return string The chunked password.
</span><span class="cx" style="display: block; padding: 0 10px"> */
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- public static function chunk_password( $raw_password ) {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ public static function chunk_password(
+ #[\SensitiveParameter]
+ $raw_password
+ ) {
</ins><span class="cx" style="display: block; padding: 0 10px"> $raw_password = preg_replace( '/[^a-z\d]/i', '', $raw_password );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> return trim( chunk_split( $raw_password, 4, ' ' ) );
</span></span></pre></div>
<a id="trunksrcwpincludesclasswpxmlrpcserverphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-includes/class-wp-xmlrpc-server.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-includes/class-wp-xmlrpc-server.php 2025-02-03 16:53:16 UTC (rev 59753)
+++ trunk/src/wp-includes/class-wp-xmlrpc-server.php 2025-02-03 19:50:50 UTC (rev 59754)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -285,7 +285,11 @@
</span><span class="cx" style="display: block; padding: 0 10px"> * @param string $password User's password.
</span><span class="cx" style="display: block; padding: 0 10px"> * @return WP_User|false WP_User object if authentication passed, false otherwise.
</span><span class="cx" style="display: block; padding: 0 10px"> */
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- public function login( $username, $password ) {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ public function login(
+ $username,
+ #[\SensitiveParameter]
+ $password
+ ) {
</ins><span class="cx" style="display: block; padding: 0 10px"> if ( ! $this->is_enabled ) {
</span><span class="cx" style="display: block; padding: 0 10px"> $this->error = new IXR_Error( 405, sprintf( __( 'XML-RPC services are disabled on this site.' ) ) );
</span><span class="cx" style="display: block; padding: 0 10px"> return false;
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -330,7 +334,11 @@
</span><span class="cx" style="display: block; padding: 0 10px"> * @param string $password User's password.
</span><span class="cx" style="display: block; padding: 0 10px"> * @return bool Whether authentication passed.
</span><span class="cx" style="display: block; padding: 0 10px"> */
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- public function login_pass_ok( $username, $password ) {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ public function login_pass_ok(
+ $username,
+ #[\SensitiveParameter]
+ $password
+ ) {
</ins><span class="cx" style="display: block; padding: 0 10px"> return (bool) $this->login( $username, $password );
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px">
</span></span></pre></div>
<a id="trunksrcwpincludesclasswpdbphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-includes/class-wpdb.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-includes/class-wpdb.php 2025-02-03 16:53:16 UTC (rev 59753)
+++ trunk/src/wp-includes/class-wpdb.php 2025-02-03 19:50:50 UTC (rev 59754)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -749,7 +749,13 @@
</span><span class="cx" style="display: block; padding: 0 10px"> * @param string $dbname Database name.
</span><span class="cx" style="display: block; padding: 0 10px"> * @param string $dbhost Database host.
</span><span class="cx" style="display: block; padding: 0 10px"> */
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- public function __construct( $dbuser, $dbpassword, $dbname, $dbhost ) {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ public function __construct(
+ $dbuser,
+ #[\SensitiveParameter]
+ $dbpassword,
+ $dbname,
+ $dbhost
+ ) {
</ins><span class="cx" style="display: block; padding: 0 10px"> if ( WP_DEBUG && WP_DEBUG_DISPLAY ) {
</span><span class="cx" style="display: block; padding: 0 10px"> $this->show_errors();
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span></span></pre></div>
<a id="trunksrcwpincludesmsfunctionsphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-includes/ms-functions.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-includes/ms-functions.php 2025-02-03 16:53:16 UTC (rev 59753)
+++ trunk/src/wp-includes/ms-functions.php 2025-02-03 19:50:50 UTC (rev 59754)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -938,7 +938,16 @@
</span><span class="cx" style="display: block; padding: 0 10px"> * @param array $meta Optional. Signup meta data. By default, contains the requested privacy setting and lang_id.
</span><span class="cx" style="display: block; padding: 0 10px"> * @return bool
</span><span class="cx" style="display: block; padding: 0 10px"> */
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-function wpmu_signup_blog_notification( $domain, $path, $title, $user_login, $user_email, $key, $meta = array() ) {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+function wpmu_signup_blog_notification(
+ $domain,
+ $path,
+ $title,
+ $user_login,
+ $user_email,
+ #[\SensitiveParameter]
+ $key,
+ $meta = array()
+) {
</ins><span class="cx" style="display: block; padding: 0 10px"> /**
</span><span class="cx" style="display: block; padding: 0 10px"> * Filters whether to bypass the new site email notification.
</span><span class="cx" style="display: block; padding: 0 10px"> *
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -1073,7 +1082,13 @@
</span><span class="cx" style="display: block; padding: 0 10px"> * @param array $meta Optional. Signup meta data. Default empty array.
</span><span class="cx" style="display: block; padding: 0 10px"> * @return bool
</span><span class="cx" style="display: block; padding: 0 10px"> */
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-function wpmu_signup_user_notification( $user_login, $user_email, $key, $meta = array() ) {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+function wpmu_signup_user_notification(
+ $user_login,
+ $user_email,
+ #[\SensitiveParameter]
+ $key,
+ $meta = array()
+) {
</ins><span class="cx" style="display: block; padding: 0 10px"> /**
</span><span class="cx" style="display: block; padding: 0 10px"> * Filters whether to bypass the email notification for new user sign-up.
</span><span class="cx" style="display: block; padding: 0 10px"> *
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -1175,7 +1190,10 @@
</span><span class="cx" style="display: block; padding: 0 10px"> * @param string $key The activation key provided to the user.
</span><span class="cx" style="display: block; padding: 0 10px"> * @return array|WP_Error An array containing information about the activated user and/or blog.
</span><span class="cx" style="display: block; padding: 0 10px"> */
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-function wpmu_activate_signup( $key ) {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+function wpmu_activate_signup(
+ #[\SensitiveParameter]
+ $key
+) {
</ins><span class="cx" style="display: block; padding: 0 10px"> global $wpdb;
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> $signup = $wpdb->get_row( $wpdb->prepare( "SELECT * FROM $wpdb->signups WHERE activation_key = %s", $key ) );
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -1327,7 +1345,12 @@
</span><span class="cx" style="display: block; padding: 0 10px"> * @param string $email The new user's email address.
</span><span class="cx" style="display: block; padding: 0 10px"> * @return int|false Returns false on failure, or int $user_id on success.
</span><span class="cx" style="display: block; padding: 0 10px"> */
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-function wpmu_create_user( $user_name, $password, $email ) {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+function wpmu_create_user(
+ $user_name,
+ #[\SensitiveParameter]
+ $password,
+ $email
+) {
</ins><span class="cx" style="display: block; padding: 0 10px"> $user_name = preg_replace( '/\s+/', '', sanitize_user( $user_name, true ) );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> $user_id = wp_create_user( $user_name, $password, $email );
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -1611,7 +1634,14 @@
</span><span class="cx" style="display: block; padding: 0 10px"> * @param array $meta Optional. Signup meta data. By default, contains the requested privacy setting and lang_id.
</span><span class="cx" style="display: block; padding: 0 10px"> * @return bool Whether the email notification was sent.
</span><span class="cx" style="display: block; padding: 0 10px"> */
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-function wpmu_welcome_notification( $blog_id, $user_id, $password, $title, $meta = array() ) {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+function wpmu_welcome_notification(
+ $blog_id,
+ $user_id,
+ #[\SensitiveParameter]
+ $password,
+ $title,
+ $meta = array()
+) {
</ins><span class="cx" style="display: block; padding: 0 10px"> $current_network = get_network();
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> /**
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -1845,7 +1875,12 @@
</span><span class="cx" style="display: block; padding: 0 10px"> * @param array $meta Optional. Signup meta data. Default empty array.
</span><span class="cx" style="display: block; padding: 0 10px"> * @return bool
</span><span class="cx" style="display: block; padding: 0 10px"> */
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-function wpmu_welcome_user_notification( $user_id, $password, $meta = array() ) {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+function wpmu_welcome_user_notification(
+ $user_id,
+ #[\SensitiveParameter]
+ $password,
+ $meta = array()
+) {
</ins><span class="cx" style="display: block; padding: 0 10px"> $current_network = get_network();
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> /**
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -2271,7 +2306,12 @@
</span><span class="cx" style="display: block; padding: 0 10px"> * @param string $password User password. Ignored.
</span><span class="cx" style="display: block; padding: 0 10px"> * @param array $meta Signup meta data.
</span><span class="cx" style="display: block; padding: 0 10px"> */
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-function add_new_user_to_blog( $user_id, $password, $meta ) {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+function add_new_user_to_blog(
+ $user_id,
+ #[\SensitiveParameter]
+ $password,
+ $meta
+) {
</ins><span class="cx" style="display: block; padding: 0 10px"> if ( ! empty( $meta['add_to_blog'] ) ) {
</span><span class="cx" style="display: block; padding: 0 10px"> $blog_id = $meta['add_to_blog'];
</span><span class="cx" style="display: block; padding: 0 10px"> $role = $meta['new_role'];
</span></span></pre></div>
<a id="trunksrcwpincludespluggabledeprecatedphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-includes/pluggable-deprecated.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-includes/pluggable-deprecated.php 2025-02-03 16:53:16 UTC (rev 59753)
+++ trunk/src/wp-includes/pluggable-deprecated.php 2025-02-03 19:50:50 UTC (rev 59754)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -101,7 +101,15 @@
</span><span class="cx" style="display: block; padding: 0 10px"> * @param string $siteurl Optional. Will be used instead of SITECOOKIEPATH if set
</span><span class="cx" style="display: block; padding: 0 10px"> * @param bool $remember Optional. Remember that the user is logged in
</span><span class="cx" style="display: block; padding: 0 10px"> */
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-function wp_setcookie($username, $password = '', $already_md5 = false, $home = '', $siteurl = '', $remember = false) {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+function wp_setcookie(
+ $username,
+ #[\SensitiveParameter]
+ $password = '',
+ $already_md5 = false,
+ $home = '',
+ $siteurl = '',
+ $remember = false
+) {
</ins><span class="cx" style="display: block; padding: 0 10px"> _deprecated_function( __FUNCTION__, '2.5.0', 'wp_set_auth_cookie()' );
</span><span class="cx" style="display: block; padding: 0 10px"> $user = get_user_by('login', $username);
</span><span class="cx" style="display: block; padding: 0 10px"> wp_set_auth_cookie($user->ID, $remember);
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -168,7 +176,12 @@
</span><span class="cx" style="display: block; padding: 0 10px"> * @param string $deprecated Not used
</span><span class="cx" style="display: block; padding: 0 10px"> * @return bool True on successful check, false on login failure.
</span><span class="cx" style="display: block; padding: 0 10px"> */
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-function wp_login($username, $password, $deprecated = '') {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+function wp_login(
+ $username,
+ #[\SensitiveParameter]
+ $password,
+ $deprecated = ''
+) {
</ins><span class="cx" style="display: block; padding: 0 10px"> _deprecated_function( __FUNCTION__, '2.5.0', 'wp_signon()' );
</span><span class="cx" style="display: block; padding: 0 10px"> global $error;
</span><span class="cx" style="display: block; padding: 0 10px">
</span></span></pre></div>
<a id="trunksrcwpincludespluggablephp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-includes/pluggable.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-includes/pluggable.php 2025-02-03 16:53:16 UTC (rev 59753)
+++ trunk/src/wp-includes/pluggable.php 2025-02-03 19:50:50 UTC (rev 59754)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -598,7 +598,11 @@
</span><span class="cx" style="display: block; padding: 0 10px"> * @return WP_User|WP_Error WP_User object if the credentials are valid,
</span><span class="cx" style="display: block; padding: 0 10px"> * otherwise WP_Error.
</span><span class="cx" style="display: block; padding: 0 10px"> */
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- function wp_authenticate( $username, $password ) {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ function wp_authenticate(
+ $username,
+ #[\SensitiveParameter]
+ $password
+ ) {
</ins><span class="cx" style="display: block; padding: 0 10px"> $username = sanitize_user( $username );
</span><span class="cx" style="display: block; padding: 0 10px"> $password = trim( $password );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -2631,7 +2635,10 @@
</span><span class="cx" style="display: block; padding: 0 10px"> * @param string $password Plain text user password to hash.
</span><span class="cx" style="display: block; padding: 0 10px"> * @return string The hash string of the password.
</span><span class="cx" style="display: block; padding: 0 10px"> */
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- function wp_hash_password( $password ) {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ function wp_hash_password(
+ #[\SensitiveParameter]
+ $password
+ ) {
</ins><span class="cx" style="display: block; padding: 0 10px"> global $wp_hasher;
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> if ( empty( $wp_hasher ) ) {
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -2667,7 +2674,12 @@
</span><span class="cx" style="display: block; padding: 0 10px"> * @param string|int $user_id Optional. User ID.
</span><span class="cx" style="display: block; padding: 0 10px"> * @return bool False, if the $password does not match the hashed password.
</span><span class="cx" style="display: block; padding: 0 10px"> */
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- function wp_check_password( $password, $hash, $user_id = '' ) {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ function wp_check_password(
+ #[\SensitiveParameter]
+ $password,
+ $hash,
+ $user_id = ''
+ ) {
</ins><span class="cx" style="display: block; padding: 0 10px"> global $wp_hasher;
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> // If the hash is still md5...
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -2863,7 +2875,11 @@
</span><span class="cx" style="display: block; padding: 0 10px"> * @param string $password The plaintext new user password.
</span><span class="cx" style="display: block; padding: 0 10px"> * @param int $user_id User ID.
</span><span class="cx" style="display: block; padding: 0 10px"> */
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- function wp_set_password( $password, $user_id ) {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ function wp_set_password(
+ #[\SensitiveParameter]
+ $password,
+ $user_id
+ ) {
</ins><span class="cx" style="display: block; padding: 0 10px"> global $wpdb;
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> $old_user_data = get_userdata( $user_id );
</span></span></pre></div>
<a id="trunksrcwpincludesrestapiendpointsclasswprestuserscontrollerphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php 2025-02-03 16:53:16 UTC (rev 59753)
+++ trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php 2025-02-03 19:50:50 UTC (rev 59754)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -1310,7 +1310,12 @@
</span><span class="cx" style="display: block; padding: 0 10px"> * @param string $param The parameter name.
</span><span class="cx" style="display: block; padding: 0 10px"> * @return string|WP_Error The sanitized password, if valid, otherwise an error.
</span><span class="cx" style="display: block; padding: 0 10px"> */
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- public function check_user_password( $value, $request, $param ) {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ public function check_user_password(
+ #[\SensitiveParameter]
+ $value,
+ $request,
+ $param
+ ) {
</ins><span class="cx" style="display: block; padding: 0 10px"> $password = (string) $value;
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> if ( empty( $password ) ) {
</span></span></pre></div>
<a id="trunksrcwpincludesuserphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-includes/user.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-includes/user.php 2025-02-03 16:53:16 UTC (rev 59753)
+++ trunk/src/wp-includes/user.php 2025-02-03 19:50:50 UTC (rev 59754)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -150,7 +150,12 @@
</span><span class="cx" style="display: block; padding: 0 10px"> * @param string $password Password for authentication.
</span><span class="cx" style="display: block; padding: 0 10px"> * @return WP_User|WP_Error WP_User on success, WP_Error on failure.
</span><span class="cx" style="display: block; padding: 0 10px"> */
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-function wp_authenticate_username_password( $user, $username, $password ) {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+function wp_authenticate_username_password(
+ $user,
+ $username,
+ #[\SensitiveParameter]
+ $password
+) {
</ins><span class="cx" style="display: block; padding: 0 10px"> if ( $user instanceof WP_User ) {
</span><span class="cx" style="display: block; padding: 0 10px"> return $user;
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -228,7 +233,12 @@
</span><span class="cx" style="display: block; padding: 0 10px"> * @param string $password Password for authentication.
</span><span class="cx" style="display: block; padding: 0 10px"> * @return WP_User|WP_Error WP_User on success, WP_Error on failure.
</span><span class="cx" style="display: block; padding: 0 10px"> */
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-function wp_authenticate_email_password( $user, $email, $password ) {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+function wp_authenticate_email_password(
+ $user,
+ $email,
+ #[\SensitiveParameter]
+ $password
+) {
</ins><span class="cx" style="display: block; padding: 0 10px"> if ( $user instanceof WP_User ) {
</span><span class="cx" style="display: block; padding: 0 10px"> return $user;
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -301,7 +311,12 @@
</span><span class="cx" style="display: block; padding: 0 10px"> * @param string $password Password. If not empty, cancels the cookie authentication.
</span><span class="cx" style="display: block; padding: 0 10px"> * @return WP_User|WP_Error WP_User on success, WP_Error on failure.
</span><span class="cx" style="display: block; padding: 0 10px"> */
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-function wp_authenticate_cookie( $user, $username, $password ) {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+function wp_authenticate_cookie(
+ $user,
+ $username,
+ #[\SensitiveParameter]
+ $password
+) {
</ins><span class="cx" style="display: block; padding: 0 10px"> global $auth_secure_cookie;
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> if ( $user instanceof WP_User ) {
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -342,7 +357,12 @@
</span><span class="cx" style="display: block; padding: 0 10px"> * @return WP_User|WP_Error|null WP_User on success, WP_Error on failure, null if
</span><span class="cx" style="display: block; padding: 0 10px"> * null is passed in and this isn't an API request.
</span><span class="cx" style="display: block; padding: 0 10px"> */
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-function wp_authenticate_application_password( $input_user, $username, $password ) {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+function wp_authenticate_application_password(
+ $input_user,
+ $username,
+ #[\SensitiveParameter]
+ $password
+) {
</ins><span class="cx" style="display: block; padding: 0 10px"> if ( $input_user instanceof WP_User ) {
</span><span class="cx" style="display: block; padding: 0 10px"> return $input_user;
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -2846,7 +2866,12 @@
</span><span class="cx" style="display: block; padding: 0 10px"> * @return int|WP_Error The newly created user's ID or a WP_Error object if the user could not
</span><span class="cx" style="display: block; padding: 0 10px"> * be created.
</span><span class="cx" style="display: block; padding: 0 10px"> */
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-function wp_create_user( $username, $password, $email = '' ) {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+function wp_create_user(
+ $username,
+ #[\SensitiveParameter]
+ $password,
+ $email = ''
+) {
</ins><span class="cx" style="display: block; padding: 0 10px"> $user_login = wp_slash( $username );
</span><span class="cx" style="display: block; padding: 0 10px"> $user_email = wp_slash( $email );
</span><span class="cx" style="display: block; padding: 0 10px"> $user_pass = $password;
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -3034,7 +3059,11 @@
</span><span class="cx" style="display: block; padding: 0 10px"> * @param string $login The user login.
</span><span class="cx" style="display: block; padding: 0 10px"> * @return WP_User|WP_Error WP_User object on success, WP_Error object for invalid or expired keys.
</span><span class="cx" style="display: block; padding: 0 10px"> */
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-function check_password_reset_key( $key, $login ) {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+function check_password_reset_key(
+ #[\SensitiveParameter]
+ $key,
+ $login
+) {
</ins><span class="cx" style="display: block; padding: 0 10px"> global $wp_hasher;
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> $key = preg_replace( '/[^a-z0-9]/i', '', $key );
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -3371,7 +3400,11 @@
</span><span class="cx" style="display: block; padding: 0 10px"> * @param WP_User $user The user
</span><span class="cx" style="display: block; padding: 0 10px"> * @param string $new_pass New password for the user in plaintext
</span><span class="cx" style="display: block; padding: 0 10px"> */
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-function reset_password( $user, $new_pass ) {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+function reset_password(
+ $user,
+ #[\SensitiveParameter]
+ $new_pass
+) {
</ins><span class="cx" style="display: block; padding: 0 10px"> /**
</span><span class="cx" style="display: block; padding: 0 10px"> * Fires before the user's password is reset.
</span><span class="cx" style="display: block; padding: 0 10px"> *
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -4932,7 +4965,11 @@
</span><span class="cx" style="display: block; padding: 0 10px"> * @param string $key Provided key to validate.
</span><span class="cx" style="display: block; padding: 0 10px"> * @return true|WP_Error True on success, WP_Error on failure.
</span><span class="cx" style="display: block; padding: 0 10px"> */
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-function wp_validate_user_request_key( $request_id, $key ) {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+function wp_validate_user_request_key(
+ $request_id,
+ #[\SensitiveParameter]
+ $key
+) {
</ins><span class="cx" style="display: block; padding: 0 10px"> global $wp_hasher;
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> $request_id = absint( $request_id );
</span></span></pre>
</div>
</div>
</body>
</html>