{"id":105,"date":"2025-02-20T00:00:00","date_gmt":"2025-02-19T23:00:00","guid":{"rendered":"https:\/\/helloblog.io\/sk\/wordpress-6-8-bcrypt-wp-password-bcrypt-bedrock\/"},"modified":"2026-01-20T06:33:00","modified_gmt":"2026-01-20T05:33:00","slug":"wordpress-6-8-bcrypt-wp-password-bcrypt-bedrock","status":"publish","type":"post","link":"https:\/\/helloblog.io\/sk\/wordpress-6-8-bcrypt-wp-password-bcrypt-bedrock\/","title":{"rendered":"WordPress 6.8 prech\u00e1dza na bcrypt: \u010do to znamen\u00e1 pre wp-password-bcrypt a Bedrock projekty"},"content":{"rendered":"\n<p>WordPress dlh\u00e9 roky dobiehal modern\u00e9 \u0161tandardy pri ukladan\u00ed hesiel. Nie\u017eeby hesl\u00e1 ukladal v otvorenom texte, ale v praxi bolo be\u017en\u00e9, \u017ee pokro\u010dilej\u0161ie projekty siahli po doplnkoch alebo bal\u00ed\u010dkoch, ktor\u00e9 posilnili hashing (t. j. jednosmern\u00e9 \u201eprehashovanie\u201c hesla do podoby, ktor\u00fa si \u00fato\u010dn\u00edk nevie rozumne zvr\u00e1ti\u0165). Jedn\u00fdm z najpou\u017e\u00edvanej\u0161\u00edch rie\u0161en\u00ed vo svete Roots bol bal\u00ed\u010dek <code>wp-password-bcrypt<\/code>.<\/p>\n\n\n\n<p>Pod\u013ea ozn\u00e1menia k WordPress 6.8 sa situ\u00e1cia men\u00ed: <strong>bcrypt sa st\u00e1va predvolenou met\u00f3dou hashovania hesiel priamo v core<\/strong>. To je d\u00f4le\u017eit\u00fd krok pre bezpe\u010dnos\u0165 autentifik\u00e1cie a z\u00e1rove\u0148 to rob\u00ed <code>wp-password-bcrypt<\/code> zbyto\u010dn\u00fdm pre weby, ktor\u00e9 be\u017eia na 6.8 a vy\u0161\u0161ie.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">R\u00fdchly kontext: \u010do je bcrypt a pre\u010do ho v\u00f4bec rie\u0161ime<\/h2>\n\n\n\n<p><strong>bcrypt<\/strong> je algoritmus na hashovanie hesiel navrhnut\u00fd tak, aby bol <em>z\u00e1merne pomal\u00fd<\/em> a t\u00fdm p\u00e1dom drah\u00fd pre \u00fatoky hrubou silou (brute force) nad datab\u00e1zou ukradnut\u00fdch hashov. V praxi to znamen\u00e1, \u017ee aj ke\u010f sa niekto dostane k tabu\u013eke s hashmi, ich hromadn\u00e9 l\u00e1manie je v\u00fdrazne n\u00e1ro\u010dnej\u0161ie ne\u017e pri r\u00fdchlych hashovac\u00edch funkci\u00e1ch.<\/p>\n\n\n\n<p>Pre WordPress projekty je to citliv\u00e1 t\u00e9ma najm\u00e4 preto, \u017ee \u00fatoky \u010dasto nejd\u00fa len cez login form, ale aj cez kompromitovan\u00fa datab\u00e1zu alebo z\u00e1lohy. Silnej\u0161\u00ed password hashing je preto \u201etich\u00fd\u201c bezpe\u010dnostn\u00fd upgrade, ktor\u00fd zni\u017euje dopady incidentu.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u010co sa men\u00ed vo WordPress 6.8<\/h2>\n\n\n\n<p>WordPress 6.8 m\u00e1 pod\u013ea ofici\u00e1lneho ozn\u00e1menia pou\u017e\u00edva\u0165 <strong>bcrypt ako default<\/strong> pre hashovanie hesiel. Pre teba ako v\u00fdvoj\u00e1ra to znamen\u00e1, \u017ee bezpe\u010dnej\u0161\u00ed hashing sa st\u00e1va \u0161tandardom bez potreby \u010fal\u0161\u00edch bal\u00ed\u010dkov alebo pluginov, ktor\u00e9 prepisuj\u00fa autentifika\u010dn\u00e9 spr\u00e1vanie.<\/p>\n\n\n\n<div class=\"wp-block-group callout callout-info is-style-info is-layout-flow wp-block-group-is-layout-flow\" style=\"border-width:1px;border-radius:8px;padding-top:1rem;padding-right:1.5rem;padding-bottom:1rem;padding-left:1.5rem\">\n\n<h4 class=\"wp-block-heading callout-title\">D\u00f4le\u017eit\u00e9<\/h4>\n\n\n<p>Toto je zmena v core WordPressu. Ak si doteraz spoliehal na extern\u00fd bal\u00ed\u010dek len kv\u00f4li bcryptu, po upgrade na 6.8 u\u017e nerie\u0161i\u0161 \u201eudr\u017eiavanie\u201c tohto bezpe\u010dnostn\u00e9ho hacku.<\/p>\n\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Sunset bal\u00ed\u010dka wp-password-bcrypt: \u010do t\u00fdm Roots mysl\u00ed<\/h2>\n\n\n\n<p>Roots ozn\u00e1mil, \u017ee ich bal\u00ed\u010dek <a href=\"https:\/\/github.com\/roots\/wp-password-bcrypt\"><code>wp-password-bcrypt<\/code><\/a> ide do \u00fatlmu (sunsetting), preto\u017ee jeho hlavn\u00fd d\u00f4vod existencie pre WordPress 6.8+ mizne. Z praktick\u00e9ho poh\u013eadu je to dobr\u00e1 spr\u00e1va: menej z\u00e1vislost\u00ed, menej \u201emagick\u00fdch\u201c z\u00e1sahov do autentifik\u00e1cie, jednoduch\u0161ia \u00fadr\u017eba.<\/p>\n\n\n\n<p>Roots z\u00e1rove\u0148 uv\u00e1dza, \u017ee urob\u00ed tieto kroky:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>na Packagiste ozna\u010d\u00ed <code>wp-password-bcrypt<\/code> ako <strong>abandoned<\/strong><\/li>\n\n\n<li>odstr\u00e1ni zmienky o bal\u00ed\u010dku z projektu <a href=\"https:\/\/github.com\/roots\/bedrock\">Bedrock<\/a> a s\u00favisiacej dokument\u00e1cie<\/li>\n\n\n<li>archivuje GitHub repozit\u00e1r bal\u00ed\u010dka<\/li>\n\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">M\u00e1m WordPress 6.8 alebo nov\u0161\u00ed: m\u00f4\u017eem wp-password-bcrypt odstr\u00e1ni\u0165?<\/h2>\n\n\n\n<p>\u00c1no \u2014 pod\u013ea Roots, ak tvoj web be\u017e\u00ed na WordPress 6.8 alebo nov\u0161om, <strong><code>wp-password-bcrypt<\/code> u\u017e nepotrebuje\u0161<\/strong>.<\/p>\n\n\n\n<p>D\u00f4le\u017eit\u00e1 \u010das\u0165 je, \u017ee odstr\u00e1nenie by malo by\u0165 \u201ebez migr\u00e1cie\u201c: <strong>existuj\u00face hesl\u00e1 maj\u00fa na\u010falej fungova\u0165<\/strong> a WordPress core m\u00e1 autentifik\u00e1ciu s bcryptom zvl\u00e1dnu\u0165 plynule tam, kde to d\u00e1va zmysel. In\u00fdmi slovami, nemal by si rie\u0161i\u0165 rehashovanie alebo n\u00faten\u00e9 resetovanie hesiel pou\u017e\u00edvate\u013eov len kv\u00f4li tomu, \u017ee vyhod\u00ed\u0161 bal\u00ed\u010dek.<\/p>\n\n\n\n<div class=\"wp-block-group callout callout-warning is-style-warning is-layout-flow wp-block-group-is-layout-flow\" style=\"border-width:1px;border-radius:8px;padding-top:1rem;padding-right:1.5rem;padding-bottom:1rem;padding-left:1.5rem\">\n\n<h4 class=\"wp-block-heading callout-title\">Pozor pri pl\u00e1novan\u00ed release<\/h4>\n\n\n<p>Pri zmene, ktor\u00e1 sa t\u00fdka prihlasovania, si nechaj priestor na r\u00fdchly rollback. Aj ke\u010f je deklarovan\u00e9, \u017ee migr\u00e1cia netreba, autentifik\u00e1cia je kritick\u00e1 cesta aplik\u00e1cie a oplat\u00ed sa to otestova\u0165 na stagingu.<\/p>\n\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Typick\u00fd postup v Bedrock\/Composer projekte<\/h2>\n\n\n\n<p>Ak m\u00e1\u0161 WordPress spravovan\u00fd cez Composer (napr. Bedrock), <code>wp-password-bcrypt<\/code> je typicky len jedna z po\u017eiadaviek v <code>composer.json<\/code>. Po upgrade WordPressu na 6.8+ d\u00e1va zmysel bal\u00ed\u010dek odstr\u00e1ni\u0165 a n\u00e1sledne nasadi\u0165.<\/p>\n\n\n\n<p>Ke\u010f\u017ee \u0161trukt\u00fara projektov sa l\u00ed\u0161i, univerz\u00e1lny pr\u00edkaz sem ned\u00e1vam. Pointa je sk\u00f4r proces:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n\n<li>Upgradni WordPress na verziu 6.8+ v prostred\u00ed, kde vie\u0161 testova\u0165 (staging).<\/li>\n\n\n<li>Odstr\u00e1\u0148 <code>wp-password-bcrypt<\/code> z Composer z\u00e1vislost\u00ed a aktualizuj lockfile.<\/li>\n\n\n<li>Nasimuluj re\u00e1lny scen\u00e1r: prihl\u00e1senie administr\u00e1tora aj be\u017en\u00e9ho pou\u017e\u00edvate\u013ea, reset hesla, vytvorenie nov\u00e9ho pou\u017e\u00edvate\u013ea.<\/li>\n\n\n<li>A\u017e potom nasadzuj do produkcie.<\/li>\n\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">\u010co ak e\u0161te nie som na 6.8?<\/h2>\n\n\n\n<p>Ak z nejak\u00e9ho d\u00f4vodu zost\u00e1va\u0161 na star\u0161ej verzii WordPressu, tento \u010dl\u00e1nok neznamen\u00e1, \u017ee <code>wp-password-bcrypt<\/code> mus\u00ed\u0161 okam\u017eite odstr\u00e1ni\u0165. Ozn\u00e1menie Roots je v\u0161ak jasn\u00fd sign\u00e1l, \u017ee bal\u00ed\u010dek u\u017e nebude do bud\u00facna smerova\u0165 ako akt\u00edvne odpor\u00fa\u010dan\u00fd komponent ekosyst\u00e9mu \u2014 ke\u010f prejde\u0161 na 6.8+, jeho pr\u00ednos sa str\u00e1ca.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Pre\u010do je to dobr\u00e1 spr\u00e1va pre bezpe\u010dnos\u0165 (a aj pre \u00fadr\u017ebu)<\/h2>\n\n\n\n<p>Ke\u010f sa bezpe\u010dnostn\u00e1 prax stane s\u00fa\u010das\u0165ou core, zlep\u0161uje to situ\u00e1ciu pre cel\u00fd ekosyst\u00e9m: nie len pre technicky zrel\u00e9 t\u00edmy s Bedrockom, ale aj pre \u201eklasick\u00e9\u201c WordPress in\u0161tal\u00e1cie, ktor\u00e9 nikdy nepou\u017eij\u00fa Composer. Z\u00e1rove\u0148 ub\u00fada fragment\u00e1cia \u2014 menej projektov, ktor\u00e9 musia prepisova\u0165 autentifik\u00e1ciu vlastn\u00fdmi hookmi, menej \u0161peci\u00e1lnych pr\u00edpadov pri upgrade.<\/p>\n\n\n\n<p>A pre n\u00e1s v\u00fdvoj\u00e1rov je to aj \u010disto praktick\u00e9: \u010fal\u0161ia z\u00e1vislos\u0165, ktor\u00fa netreba auditova\u0165, aktualizova\u0165 a vysvet\u013eova\u0165.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Zhrnutie<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>WordPress 6.8 m\u00e1 pou\u017e\u00edva\u0165 <strong>bcrypt ako predvolen\u00fd<\/strong> password hashing v core.<\/li>\n\n\n<li>Bal\u00ed\u010dek <code>wp-password-bcrypt<\/code> t\u00fdm p\u00e1dom v projektoch na 6.8+ str\u00e1ca zmysel.<\/li>\n\n\n<li>Roots ho ozna\u010d\u00ed ako abandoned, odstr\u00e1ni ho z Bedrock dokument\u00e1cie a repozit\u00e1r archivuje.<\/li>\n\n\n<li>Pri WordPress 6.8+ m\u00f4\u017ee\u0161 bal\u00ed\u010dek odstr\u00e1ni\u0165 bez \u0161peci\u00e1lnej migr\u00e1cie; existuj\u00face hesl\u00e1 maj\u00fa \u010falej fungova\u0165.<\/li>\n\n<\/ul>\n\n\n<div class=\"references-section\">\n                <h2>Referencie \/ Zdroje<\/h2>\n                <ul class=\"references-list\"><li><a href=\"https:\/\/roots.io\/sunsetting-wp-password-bcrypt-with-wordpress-6-8\/\" target=\"_blank\" rel=\"noopener noreferrer\">Sunsetting wp-password-bcrypt with WordPress 6.8<\/a><\/li><li><a href=\"https:\/\/make.wordpress.org\/core\/2025\/02\/17\/wordpress-6-8-will-use-bcrypt-for-password-hashing\/\" target=\"_blank\" rel=\"noopener noreferrer\">WordPress 6.8 will use bcrypt for password hashing<\/a><\/li><li><a href=\"https:\/\/github.com\/roots\/wp-password-bcrypt\" target=\"_blank\" rel=\"noopener noreferrer\">roots\/wp-password-bcrypt<\/a><\/li><li><a href=\"https:\/\/github.com\/roots\/bedrock\" target=\"_blank\" rel=\"noopener noreferrer\">roots\/bedrock<\/a><\/li><\/ul>\n            <\/div>","protected":false},"excerpt":{"rendered":"<p>Ak m\u00e1\u0161 v projekte wp-password-bcrypt, WordPress 6.8 ti pravdepodobne dovol\u00ed ho bezbolestne vyhodi\u0165. Core toti\u017e prech\u00e1dza na bcrypt ako predvolen\u00fd hash hesiel a bezpe\u010dnostn\u00fd \u201epatch\u201c navy\u0161e u\u017e nebude potrebn\u00fd.<\/p>\n","protected":false},"author":37,"featured_media":104,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[72,71,73,37,10],"class_list":["post-105","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-bezpecnost","tag-autentifikacia","tag-bcrypt","tag-bedrock","tag-bezpecnost","tag-wordpress"],"_links":{"self":[{"href":"https:\/\/helloblog.io\/sk\/wp-json\/wp\/v2\/posts\/105","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/helloblog.io\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/helloblog.io\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/helloblog.io\/sk\/wp-json\/wp\/v2\/users\/37"}],"replies":[{"embeddable":true,"href":"https:\/\/helloblog.io\/sk\/wp-json\/wp\/v2\/comments?post=105"}],"version-history":[{"count":1,"href":"https:\/\/helloblog.io\/sk\/wp-json\/wp\/v2\/posts\/105\/revisions"}],"predecessor-version":[{"id":126,"href":"https:\/\/helloblog.io\/sk\/wp-json\/wp\/v2\/posts\/105\/revisions\/126"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/helloblog.io\/sk\/wp-json\/wp\/v2\/media\/104"}],"wp:attachment":[{"href":"https:\/\/helloblog.io\/sk\/wp-json\/wp\/v2\/media?parent=105"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/helloblog.io\/sk\/wp-json\/wp\/v2\/categories?post=105"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/helloblog.io\/sk\/wp-json\/wp\/v2\/tags?post=105"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}