Deprecated: pathinfo(): Passing null to parameter #1 ($path) of type string is deprecated in /data/sites/web/remonpelnl/www/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 84
So. Fair warning. RANT incoming!.
Recently been working on an issue regarding GravityForms. When a visitor submits a file, the file is stored in a ‘secure’ location, which uses wp_hash to determine this ‘secure’ filepath. The link in the email is also ‘secured’ with this hash. Now, is this wrong? no. but it is also NOT correct. As you see, wp_hash uses the AUTH salt and key, which are used for user authentication, aka, login. One of the security measures we take is to prefix the AUTH tokens with a few things that make sure the user is logged out (for example) when the internet connection changes. (Your laptop gets stolen, that sucks, but your website login is invalid, so that stays safe.)
But when the AUTH tokens change …
so do the paths to files and thus, GF uploads no longer downloadable with old URLs.
Of course, being a long time developer, I developed my way around this, but still; the wp_hash function allows a second parameter staging which token-set to use, and with some magic, you can even define your own.
Well. Today it got worse.
Different client reports to me; I have an error in my NavMenu widget. It says
|
1 |
The "nav_menu" block was affected by errors and may not function properly. Check the developer tools for more details. |
So, turns out, a Gutenberg-style widget stores the instance in a BASE64 string and a hash, based on … yes, you guessed it!,
wp_hash with the default second parameter, thus the AUTH tokens. Now, this website is not in hi-secure mode, but we did migrate the data from a staging site to a production site with … drumroll please … different hashing salts… Because that’s what you do. That’s the safe way.
This madness has to end!
Stop using wp_hash with the default ‘auth’ parameter for things that are NOT authentication.
