Comment WordPress crypte le mot de passe?

Labibliothèque de chiffrement desmots depasse setrouve dans/wp-includes/class-phpass.php.Il s'agit du cadre de hachage demot depasse PHPportable .

The password encryption library is in /wp-includes/class-phpass.php. It is the Portable PHP Password hashing framework.

Il semble que vous souhaitiez utiliser du codeexternepour valider lesnoms d'utilisateur/mots depassepar rapport à labase de données de WP. Si c'estexact,vous allezpasserbeaucoup detemps à réinventer la roue. Maispour unbonexemple de lafaçon defaire celaen utilisant PHP simple,c'est unebonneidée dejeter un œil auxfonctions WP debase qui lefont déjà.

Exemple concret,`wp_check_password () ':

 function wp_check_password($password, $hash, $user_id = '') {
    global $wp_hasher;

    // If the hash is still md5...
    if ( strlen($hash) <= 32 ) {
        $check = ( $hash == md5($password) );
        if ( $check && $user_id ) {
            // Rehash using new hash.
            wp_set_password($password, $user_id);
            $hash = wp_hash_password($password);
        }

        return apply_filters('check_password', $check, $password, $hash, $user_id);
    }

    // If the stored hash is longer than an MD5, presume the
    // new style phpass portable hash.
    if ( empty($wp_hasher) ) {
        require_once ( ABSPATH . 'wp-includes/class-phpass.php');
        // By default, use the portable hash from phpass
        $wp_hasher = new PasswordHash(8, TRUE);
    }

    $check = $wp_hasher->CheckPassword($password, $hash);

    return apply_filters('check_password', $check, $password, $hash, $user_id);
}
 

Tout d'abord,WordPress vérifie si lemot depasse haché de l'utilisateur utilisetoujours le MD5 old-schoolpour la sécurité. Celapermet depréserver la compatibilité ascendante desmises àjour. Si lemot depasse est MD5,WordPress le remplacera automatiquementpar unnouveau hachageen utilisant lenouveau système (l'appel à wp_set_password()). Si cen'est pas MD5,WPpasse à lanouvelle configuration de hachage.

Tout d'abord,nousincluons le Portable PHP Hashing Framework (déjàmentionnépar @John Watson dans une autre réponse)et en créons uneinstance,en le stockant dans la variableglobale $wp_hasher.

Noustransmettonsensuite lemot depasseen texte clairet le hachagepour le vérifier,en utilisant laméthode CheckPassword() de labibliothèque.

Si vous souhaitez l'utiliser dans unebibliothèqueexterne,vous devrez d'abord include/require labibliothèque,puis l'instancier,puistransmettre votretextebrutmot depasseet son hachage. Donc,quelques untested psuedo-code ...

 function validate_password( $plaintext, $hash ) {
    require_once( 'class-phpass.php' );
    $hasher = new PasswordHash(8, TRUE);

    return $hasher->CheckPassword( $plaintext, $hash );
}
 

It sounds like you want to use external code to validate usernames/passwords against WP's database. If that's correct, you're going to spend a lot of time reinventing the wheel. But for a good example of how to do this using straight PHP, it's a good idea to take a look at the core WP functions that already do it.

Case in point, `wp_check_password()':

function wp_check_password($password, $hash, $user_id = '') {
    global $wp_hasher;

    // If the hash is still md5...
    if ( strlen($hash) <= 32 ) {
        $check = ( $hash == md5($password) );
        if ( $check && $user_id ) {
            // Rehash using new hash.
            wp_set_password($password, $user_id);
            $hash = wp_hash_password($password);
        }

        return apply_filters('check_password', $check, $password, $hash, $user_id);
    }

    // If the stored hash is longer than an MD5, presume the
    // new style phpass portable hash.
    if ( empty($wp_hasher) ) {
        require_once ( ABSPATH . 'wp-includes/class-phpass.php');
        // By default, use the portable hash from phpass
        $wp_hasher = new PasswordHash(8, TRUE);
    }

    $check = $wp_hasher->CheckPassword($password, $hash);

    return apply_filters('check_password', $check, $password, $hash, $user_id);
}

First, WordPress checks to see if the user's hashed password is still using old-school MD5 for security. This is to preserve backwards compatibility for updates. If the password is MD5, then WordPress will automatically replace it with a new hash using the new system (the call to wp_set_password()). If it isn't MD5, then WP moves on to the newer hashing setup.

First, we include the Portable PHP Hashing Framework (already mentioned by @John Watson in another answer) and create an instance of it, storing it in the global $wp_hasher variable.

We then pass in the plaintext password and the hash to verify it against, using the CheckPassword() method of the library.

If you want to use this in an external library, you'll have to first include/require the library, then instantiate it, then pass in your plain text password and its hash. So some untested psuedo-code ...

function validate_password( $plaintext, $hash ) {
    require_once( 'class-phpass.php' );
    $hasher = new PasswordHash(8, TRUE);

    return $hasher->CheckPassword( $plaintext, $hash );
}

 require_once( '/path/to/wp-includes/class-phpass.php' );
$wp_hasher = new PasswordHash( 8, TRUE );
$password = 'swordfish';
$hashed_password = $wp_hasher->HashPassword( $password );
 

require_once( '/path/to/wp-includes/class-phpass.php' );
$wp_hasher = new PasswordHash( 8, TRUE );
$password = 'swordfish';
$hashed_password = $wp_hasher->HashPassword( $password );