Salting functions: translate the phrase put your unique phrase here.

[whaze]

Trac ticket: https://core.trac.wordpress.org/ticket/55937

---

This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.

[costdev]

Thanks for working on this PR @whaze! This looks good to me! 👍

[peterwilsoncc]

Something that was mentioned in the original ticket is that there placeholder phrase appears elsewhere in WordPress

wordpress-develop/src/wp-admin/maint/repair.php

Line 40 in 2b0e2d6

$default_key = 'put your unique phrase here';

and

wordpress-develop/src/wp-includes/class-wp-recovery-mode-cookie-service.php

Lines 200 to 234 in 5ebe289

	private function recovery_mode_hash( $data ) {
	if ( ! defined( 'AUTH_KEY' ) || AUTH_KEY === 'put your unique phrase here' ) {
	$auth_key = get_site_option( 'recovery_mode_auth_key' );
	if ( ! $auth_key ) {
	if ( ! function_exists( 'wp_generate_password' ) ) {
	require_once ABSPATH . WPINC . '/pluggable.php';
	}
	$auth_key = wp_generate_password( 64, true, true );
	update_site_option( 'recovery_mode_auth_key', $auth_key );
	}
	} else {
	$auth_key = AUTH_KEY;
	}
	if ( ! defined( 'AUTH_SALT' ) || AUTH_SALT === 'put your unique phrase here' || AUTH_SALT === $auth_key ) {
	$auth_salt = get_site_option( 'recovery_mode_auth_salt' );
	if ( ! $auth_salt ) {
	if ( ! function_exists( 'wp_generate_password' ) ) {
	require_once ABSPATH . WPINC . '/pluggable.php';
	}
	$auth_salt = wp_generate_password( 64, true, true );
	update_site_option( 'recovery_mode_auth_salt', $auth_salt );
	}
	} else {
	$auth_salt = AUTH_SALT;
	}
	$secret = $auth_key . $auth_salt;
	return hash_hmac( 'sha1', $data, $secret );
	}

@whaze are you able to look at accounting for those values too? I didn't realise until it was pointed out by another contributor on the ticket.

[audrasjb]

Closing in favor of #3289 which addresses @peterwilsoncc 's comments :)