Re:WordPress 3.6 arrives with better post locking, built-in ...
by rmccue on Friday August 02, 2013 @04:34AM
(#6145934)
To clarify: I'm not part of the core team, I'm just a contributor. (I've also only briefly looked at this issue.) Keep in mind that while I'm an active contributor, I don't speak on behalf of the core/security teams.
The aforementioned bug is in the phpass library used in WordPress. As fun as implementing our own cryptography is, we use the phpass library to abstract ourselves from this. Personally, I'd say this is something that phpass should be handling, as the use of crypt_private() is an implementation detail that we shouldn't need to know or worry about.
(This is also an issue that affects a small portion of sites, as "Exploitation of this vulnerability is possible only when there is at least one password protected post on the blog.")
As to the response from the security team (which is not exactly the core team), that's something I've called them out on before. Security is a serious issue that is usually handled very well on WP's behalf, but there have been a few notable instances lately where it's not.
(Also, the reason I "narrow down" the answers is because there are smaller "security" issues that tend to boil down to "admins can do anything", which is intentional.)
The aforementioned bug is in the phpass library used in WordPress. As fun as implementing our own cryptography is, we use the phpass library to abstract ourselves from this. Personally, I'd say this is something that phpass should be handling, as the use of crypt_private() is an implementation detail that we shouldn't need to know or worry about.
(This is also an issue that affects a small portion of sites, as "Exploitation of this vulnerability is possible only when there is at least one password protected post on the blog.")
As to the response from the security team (which is not exactly the core team), that's something I've called them out on before. Security is a serious issue that is usually handled very well on WP's behalf, but there have been a few notable instances lately where it's not.
(Also, the reason I "narrow down" the answers is because there are smaller "security" issues that tend to boil down to "admins can do anything", which is intentional.)