[wp-trac] Re: [WordPress Trac] #5367: Wordpress cookie authentication vulnerability

WordPress Trac wp-trac at lists.automattic.com
Mon Dec 17 09:47:06 GMT 2007


#5367: Wordpress cookie authentication vulnerability
-------------------------------------+--------------------------------------
 Reporter:  sjmurdoch                |        Owner:  westi   
     Type:  defect                   |       Status:  assigned
 Priority:  normal                   |    Milestone:  2.4     
Component:  Security                 |      Version:  2.3.1   
 Severity:  normal                   |   Resolution:          
 Keywords:  security, password, md5  |  
-------------------------------------+--------------------------------------
Comment (by DD32):

 Replying to [comment:52 sambauers]:
 > So what do you think about making SECRET_KEY a mandatory config setting?

 Bad idea IMO, Mainly for upgrading purposes, However, I would suggest that
 it be included in the sample-config.php so that new installations set the
 secret straight up.

 I think auth plugins should instruct users to set the secret key instead,
 As not many users actually use the integration plugins.

-- 
Ticket URL: <http://trac.wordpress.org/ticket/5367#comment:53>
WordPress Trac <http://trac.wordpress.org/>
WordPress blogging software


More information about the wp-trac mailing list