Correct rehash check to use actual hash

craigk5n · Oct 14, 2021 · 07cb27f · 07cb27f
1 parent a73ee4e
commit 07cb27f
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/includes/user.php b/includes/user.php
@@ -56,7 +56,7 @@ function user_valid_login ( $login, $password, $silent=false ) {
       } else {
         // New-Style Secure Password
         $okay = password_verify ( $password, $expected_hash );
-        $rehash = password_needs_rehash ( $hash, PASSWORD_DEFAULT );
+        $rehash = password_needs_rehash ( $expected_hash, PASSWORD_DEFAULT );
       }
       // Upgrade insecurely stored passwords
       if ( $okay && $rehash ){