[wp-trac] [WordPress Trac] #65144: Passwords: trim() asymmetry between wp_hash_password() and wp_check_password() introduced in 6.8

[WordPress Trac]

#65144: Passwords: trim() asymmetry between wp_hash_password() and
wp_check_password() introduced in 6.8
--------------------------+------------------------------
 Reporter:  mkultraware   |       Owner:  (none)
     Type:  defect (bug)  |      Status:  new
 Priority:  normal        |   Milestone:  Awaiting Review
Component:  General       |     Version:  6.8
 Severity:  normal        |  Resolution:
 Keywords:  has-patch     |     Focuses:
--------------------------+------------------------------

Comment (by ankitv):

 The asymmetry is in the bcrypt path only. wp_hash_password()
 calls trim() before hash_hmac() but wp_check_password() does not,
 causing login failures for passwords with leading/trailing
 whitespace when wp_check_password() is called directly.

 Fix: add trim() to the password argument in wp_check_password()
 to match wp_hash_password().


 Patch submitted via PR: https://github.com/Anny0007/AV-wordpress-
 develop/pull/2

 Please update keywords to has-patch.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/65144#comment:4>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform