Not working anymore after wordpress 6.8 update

[burakka]

Since the password hashing algorithm changed in wordpress 6.8 it doesn't work anymore...
WordPress 6.8 will use bcrypt for password hashing

[akashkaushik33]

Thanks for reporting @burakka , I will check what needs to be done.

[burakka]

Thanks @akashkaushik33 , I think i found the problem and a possible fix. Maybe it helps. The wp_generate_auth_cookie() function in wordpress (wp-includes/pluggable.php line 868) changed the way they use password fragments. They also have a logic for compatibility with previous wp versions.

if ( str_starts_with( $user->user_pass, '$P$' ) || str_starts_with( $user->user_pass, '$2y$' ) ) {
	// Retain previous behaviour of phpass or vanilla bcrypt hashed passwords.
	$pass_frag = substr( $user->user_pass, 8, 4 );
} else {
	// Otherwise, use a substring from the end of the hash to avoid dealing with potentially long hash prefixes.
	$pass_frag = substr( $user->user_pass, -4 );
}

In your code in wp-auth.js on line 402 i found the piece it corresponds to it. I fixed it by changing:

auth.known_hashes[user_login] = {
	frag: data.user_pass.substr(8, 4),
	id: data.ID,
};

into:

auth.known_hashes[user_login] = {
	frag: data.user_pass.substr(-4),
	id: data.ID,
};

But to keep the compability like wordpress does it, i changed it into the code below but not tested it with older versions of wordpress:

var new_frag;
if (data.user_pass.startsWith('$P$') || data.user_pass.startsWith('$2y$')) {
	new_frag = data.user_pass.substr(8, 4);
} else {
	new_frag = data.user_pass.substr(-4);
}
auth.known_hashes[user_login] = {
	frag: new_frag,
	id: data.ID,
};

I hope this helps with the fix. Thanks again...

[akashkaushik33]

Hey @burakka thank you for the fix.
I will test it out with the prev version of wp and release the fix