Night Dreaming (by Sudar)

I just found a bug in WordPress 2.5, which is exposed when it is run in PHP 4.3.11. I thought of detailing about it here so that it will be useful for others who are seeking solution for the similar problem.

Recently I was trying to integrate WordPress and BBPress to make them share a single database and cookie. The advantage of this integration is that a logged in user can share the session between WordPress and BBPress.

Right now the latest version of BBPress is 0.9 and it can be integrated only with WordPress 2.5. Only BBPress 1.0 (which is in alpha) can be integrated with WordPress 2.7. There is an excellent tutorial by _ck_ which explains the reasons behind this and it also has a step by step guide to integrate them.

I tested this integration in my test server running PHP 5 and was able to do it within minutes. But when I tried to do it in another server running PHP 4.3.11, it was not working. After lot of head banging and hair picking, I found out that there is a bug in WordPress 2.5, which does not allow you to share the cookie with BBPress 0.9 under PHP 4.

The following is the technical detail about the bug. If you are not technically inclined, you can safely skip it. You only need to remember that you cannot integrate WordPress 2.5 and BBPress 0.9 in PHP 4, you have to use WordPress 2.5.1

Well for the brave hearts here is the explanation. 🙂

In both WordPress and BBPress, the function wp_hash() is used to generate the hash, which is required to encrypt the cookie.

In WordPress 2.5, the function wp_hash() is defined in wp-includes/pluggable.php file as

function wp_hash($data) {
    $salt = wp_salt();

    if ( function_exists('hash_hmac') ) {
        return hash_hmac('md5', $data, $salt);
    } else {
        return md5($data . $salt);
    }
}

It checks whether the function hash_hmac()is present. If not it generates the hash using the function md5(). The problem is that hash_hmac() is present only in PHP 5 and WordPress includes a copy of hash_hmac() function in the wp-includes/compat.php file for backward compatibility.

But in BBPress, wp_hash() function is defined in bb-includes/pluggable.php as

function wp_hash($data) {
    $salt = wp_salt();

    return hash_hmac('md5', $data, $salt);
}

This bug is present in WordPress 2.5 and will only affect servers running PHP 4. So if you are running PHP 4 and want to integrate WordPress and BBPress, then you have to use WordPress 2.5.1 and not 2.5.

Hope this explanation saves some hair for someone somewhere, doing something similar. 🙂