Merge pull request #1 from karks88/karks88-patch-1

Update wp-multisite-sso.php
karks88 · Mar 26, 2021 · e8605fe · e8605fe
2 parents d4ae271 + 030a58f
commit e8605fe
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/wp-multisite-sso.php b/wp-multisite-sso.php
@@ -144,7 +144,7 @@ public static function handle_login( $username, $user ) {
 		}
 
 		// encrypt the sso object
-		$cipher = 'AES-128-ECB';
+		$cipher = 'AES-128-CBC';
 		$iv     = openssl_random_pseudo_bytes( openssl_cipher_iv_length( $cipher ) );
 
 		$sso_objects = array_map( function( $sso_object ) use ( $iv, $cipher ) {
@@ -191,7 +191,7 @@ private static function authenticate_user_on_blog() {
 		$sso         = base64_decode( esc_attr( $request_sso ) );
 
 		// Decrypt the SSO object.
-		$cipher     = 'AES-128-ECB';
+		$cipher     = 'AES-128-CBC';
 		$ivlen      = openssl_cipher_iv_length( $cipher );
 		$iv         = substr( $sso, 0, $ivlen );
 		$sha2len    = 32;