wp_password_needs_rehash( string $hash, string|int $user_id = '' ): bool

Source

function wp_password_needs_rehash( $hash, $user_id = '' ) {
	global $wp_hasher;

	if ( ! empty( $wp_hasher ) ) {
		return false;
	}

	/** This filter is documented in wp-includes/pluggable.php */
	$algorithm = apply_filters( 'wp_hash_password_algorithm', PASSWORD_BCRYPT );

	/** This filter is documented in wp-includes/pluggable.php */
	$options = apply_filters( 'wp_hash_password_options', array(), $algorithm );

	$prefixed = str_starts_with( $hash, '$wp' );

	if ( ( PASSWORD_BCRYPT === $algorithm ) && ! $prefixed ) {
		// If bcrypt is in use and the hash is not prefixed then it needs to be rehashed.
		$needs_rehash = true;
	} else {
		// Otherwise check the hash minus its prefix if necessary.
		$hash_to_check = $prefixed ? substr( $hash, 3 ) : $hash;
		$needs_rehash  = password_needs_rehash( $hash_to_check, $algorithm, $options );
	}

	/**
	 * Filters whether the password hash needs to be rehashed.
	 *
	 * @since 6.8.0
	 *
	 * @param bool       $needs_rehash Whether the password hash needs to be rehashed.
	 * @param string     $hash         The password hash.
	 * @param string|int $user_id      Optional. ID of a user associated with the password.
	 */
	return apply_filters( 'password_needs_rehash', $needs_rehash, $hash, $user_id );
}

View all references View on Trac View on GitHub