diff --git a/lib/Models/Subscriber.php b/lib/Models/Subscriber.php index a874dfa1b0..2d04d5453e 100644 --- a/lib/Models/Subscriber.php +++ b/lib/Models/Subscriber.php @@ -36,7 +36,6 @@ class Subscriber extends Model { const STATUS_UNCONFIRMED = 'unconfirmed'; const STATUS_BOUNCED = 'bounced'; const STATUS_INACTIVE = 'inactive'; - const SUBSCRIBER_TOKEN_LENGTH = 6; /** @var string|bool */ public $token; @@ -108,13 +107,13 @@ class Subscriber extends Model { return self::where('wp_user_id', $wp_user->ID)->findOne(); } - static function generateToken($email = null) { + static function generateToken($email = null, $length = 32) { if ($email !== null) { $auth_key = ''; if (defined('AUTH_KEY')) { $auth_key = AUTH_KEY; } - return substr(md5($auth_key . $email), 0, self::SUBSCRIBER_TOKEN_LENGTH); + return substr(md5($auth_key . $email), 0, $length); } return false; } @@ -122,8 +121,8 @@ class Subscriber extends Model { static function verifyToken($email, $token) { return call_user_func( 'hash_equals', - self::generateToken($email), - substr($token, 0, self::SUBSCRIBER_TOKEN_LENGTH) + self::generateToken($email, strlen($token)), + $token ); } diff --git a/tests/integration/Models/SubscriberTest.php b/tests/integration/Models/SubscriberTest.php index e3b5c8fd65..c49e829d20 100644 --- a/tests/integration/Models/SubscriberTest.php +++ b/tests/integration/Models/SubscriberTest.php @@ -648,7 +648,7 @@ class SubscriberTest extends \MailPoetTest { function testItGeneratesSubscriberToken() { $token = Subscriber::generateToken($this->test_data['email']); - expect(strlen($token))->equals(Subscriber::SUBSCRIBER_TOKEN_LENGTH); + expect(strlen($token))->equals(32); } function testItVerifiesSubscriberToken() { @@ -658,8 +658,7 @@ class SubscriberTest extends \MailPoetTest { } function testItVerifiesTokensOfDifferentLengths() { - $token = md5(AUTH_KEY . $this->test_data['email']); - expect(strlen($token))->notEquals(Subscriber::SUBSCRIBER_TOKEN_LENGTH); + $token = Subscriber::generateToken($this->test_data['email'], 6); expect(Subscriber::verifyToken($this->test_data['email'], $token))->true(); }