Make use of \wcf\SensitiveArgument attribute

diff --git a/wcfsetup/install/files/lib/data/user/User.class.php b/wcfsetup/install/files/lib/data/user/User.class.php
index 6a4b820aac248df6841ae48e5a26ea0bac39e59c..315298427814d5013c373121b57b951d13f2d675 100644 (file)
--- a/wcfsetup/install/files/lib/data/user/User.class.php
+++ b/wcfsetup/install/files/lib/data/user/User.class.php
@@ -152,8 +152,13 @@ final class User extends DatabaseObject implements IPopoverObject, IRouteControl
      * @param string $password
      * @return  bool        password correct
      */
-    public function checkPassword($password)
-    {
+    public function checkPassword(
+        // phpcs:disable Squiz.Functions.FunctionDeclarationArgumentSpacing.SpacingAfterHint
+        // phpcs:disable Squiz.Functions.MultiLineFunctionDeclaration.FirstParamSpacing
+        // https://github.com/squizlabs/PHP_CodeSniffer/pull/3320
+        #[\wcf\SensitiveArgument()]
+        $password
+    ) {
         $isValid = false;
 
         $manager = PasswordAlgorithmManager::getInstance();

diff --git a/wcfsetup/install/files/lib/system/user/authentication/DefaultUserAuthentication.class.php b/wcfsetup/install/files/lib/system/user/authentication/DefaultUserAuthentication.class.php
index 1515bd3860c1e670ff4a2fdbe1ba0ebf2703d6c5..2f22167665af472ab67f2215e5ca776379335e7e 100644 (file)
--- a/wcfsetup/install/files/lib/system/user/authentication/DefaultUserAuthentication.class.php
+++ b/wcfsetup/install/files/lib/system/user/authentication/DefaultUserAuthentication.class.php
@@ -34,8 +34,14 @@ class DefaultUserAuthentication extends AbstractUserAuthentication
     /**
      * @inheritDoc
      */
-    public function loginManually($username, $password, $userClassname = User::class)
-    {
+    public function loginManually(
+        $username,
+        // phpcs:disable Squiz.Functions.FunctionDeclarationArgumentSpacing.SpacingAfterHint
+        // https://github.com/squizlabs/PHP_CodeSniffer/pull/3320
+        #[\wcf\SensitiveArgument()]
+        $password,
+        $userClassname = User::class
+    ) {
         $user = $this->getUserByLogin($username);
         $userSession = (\get_class($user) == $userClassname ? $user : new $userClassname(null, null, $user));