Bug line 325 password-protected.php

[stilez]

I tested this plugin after setting up a simple site password "1235".

Attemoting to login got an error message that one of the args being passed to hash_equals() on line 325 was boolean not string,

Changing hash_equals($pwd...) to hash_equals( (string)$pwd...) didn't help. So I suspect its the 2nd arg that's the issue.

When I bypassed the test totally, by changing if (hash_equals(...) || ... to if (true || hash_equals(...) || ... , login worked fine, so it's definitely some typecasting error going on somewhere, that errors in that line.

Asked a friend to test from their phone, some miles away. Different device and connection. Same exact thing.

And yes, I can see that it just called md5() on the $_REQUEST value of the password, which should return a string. I have no idea why this error happened. Maybe someone else does?

[bikubi]

This appears to happen when no password is set, or when there was an error setting a password -- I failed to fill the "repeat password" field in the admin settings. When I corrected that, the error went away.

Of course this should not happen in the first place.

I haven't had time to really look into it, but I guess get_option returns false here when the option password_protected_password is not set.

Also no good idea where to catch this.

I'm on a very fresh WP 6.1.1, no other plugins.

Here's a stack trace:

Fatal error: Uncaught TypeError: hash_equals(): Argument # 1 ($known_string) must be of type string, bool given in /redacted/htdocs/wordpress/wp-content/plugins/password-protected/password-protected.php:305
Stack trace:
0 /redacted/htdocs/wordpress/wp-content/plugins/password-protected/password-protected.php(305): hash_equals()
1 /redacted/htdocs/wordpress/wp-includes/class-wp-hook.php(308): Password_Protected->maybe_process_login()
2 /redacted/htdocs/wordpress/wp-includes/class-wp-hook.php(332): WP_Hook->apply_filters()
3 /redacted/htdocs/wordpress/wp-includes/plugin.php(517): WP_Hook->do_action()
4 /redacted/htdocs/wordpress/wp-settings.php(617): do_action()
5 /redacted/htdocs/wordpress/wp-config.php(117): require_once('...')
6 /redacted/htdocs/wordpress/wp-load.php(50): require_once('...')
7 /redacted/htdocs/wordpress/wp-blog-header.php(13): require_once('...')
8 /redacted/htdocs/wordpress/index.php(17): require('...')
9 {main} thrown in /redacted/htdocs/wordpress/wp-content/plugins/password-protected/password-protected.php on line 305

[bikubi]

ARGGH the stack trace contained hash-number (now corrected), so I just mentioned issues 1 through 9...
apologies to all the issue authors who I pinged!!