Dotclear

Changeset 3627:9bccfc2257ad


Ignore:
Timestamp:
12/19/17 17:27:59 (6 years ago)
Author:
franck <carnet.franck.paul@…>
Branch:
default
Message:

Use PHP 5.5+ new password functions, closes #2182

Warnings:

  • $core->auth->crypt($pwd) doesn't return twice the same result for a single $pwd, so if you need this old behaviour use the $core->auth->cryptLegacy($pwd) instead.
  • $core->auth->checkPassword($pwd) must be used with an uncrypted password string as argument.
  • if you need a unique UID/key, use http::browserUID(DC_MASTER_KEY.$core->auth->userID().$core->auth->cryptLegacy($core->auth->userID())). (may be refined in future)
Files:
14 edited

Legend:

Unmodified
Added
Removed

  • admin/auth.php

    r3421 r3627  
    209209 
    210210     $cookie_admin = http::browserUID(DC_MASTER_KEY.$user_id. 
    211           $core->auth->crypt($user_pwd)).bin2hex(pack('a32',$user_id)); 
     211          $core->auth->cryptLegacy($user_id)).bin2hex(pack('a32',$user_id)); 
    212212 
    213213     if ($check_perms && $core->auth->mustChangePassword()) 

  • admin/blog_del.php

    r3036 r3627  
    3737if (!$core->error->flag() && $blog_id && !empty($_POST['del'])) 
    3838{ 
    39      if (!$core->auth->checkPassword($core->auth->crypt($_POST['pwd']))) { 
     39     if (!$core->auth->checkPassword($_POST['pwd'])) { 
    4040          $core->error->add(__('Password verification failed')); 
    4141     } else { 

  • admin/langs.php

    r3491 r3627  
    9393     try 
    9494     { 
    95           if (empty($_POST['your_pwd']) || !$core->auth->checkPassword($core->auth->crypt($_POST['your_pwd']))) { 
     95          if (empty($_POST['your_pwd']) || !$core->auth->checkPassword($_POST['your_pwd'])) { 
    9696               throw new Exception(__('Password verification failed')); 
    9797          } 
    … …  
    136136     try 
    137137     { 
    138           if (empty($_POST['your_pwd']) || !$core->auth->checkPassword($core->auth->crypt($_POST['your_pwd']))) { 
     138          if (empty($_POST['your_pwd']) || !$core->auth->checkPassword($_POST['your_pwd'])) { 
    139139               throw new Exception(__('Password verification failed')); 
    140140          } 

  • admin/post.php

    r3606 r3627  
    698698          $preview_url = 
    699699          $core->blog->url.$core->url->getURLFor('preview',$core->auth->userID().'/'. 
    700           http::browserUID(DC_MASTER_KEY.$core->auth->userID().$core->auth->getInfo('user_pwd')). 
     700          http::browserUID(DC_MASTER_KEY.$core->auth->userID().$core->auth->cryptLegacy($core->auth->userID())). 
    701701          '/'.$post->post_url); 
    702702          echo '<a id="post-preview" href="'.$preview_url.'" class="button modal" accesskey="p">'.__('Preview').' (p)'.'</a>'; 

  • admin/preferences.php

    r3566 r3627  
    161161     try 
    162162     { 
    163           $pwd_check = !empty($_POST['cur_pwd']) && $core->auth->checkPassword($core->auth->crypt($_POST['cur_pwd'])); 
     163          $pwd_check = !empty($_POST['cur_pwd']) && $core->auth->checkPassword($_POST['cur_pwd']); 
    164164 
    165165          if ($core->auth->allowPassChange() && !$pwd_check && $user_email != $_POST['user_email']) { 

  • admin/user.php

    r3421 r3627  
    7272     try 
    7373     { 
    74           if (empty($_POST['your_pwd']) || !$core->auth->checkPassword($core->auth->crypt($_POST['your_pwd']))) { 
     74          if (empty($_POST['your_pwd']) || !$core->auth->checkPassword($_POST['your_pwd'])) { 
    7575               throw new Exception(__('Password verification failed')); 
    7676          } 

  • admin/users_actions.php

    r3183 r3627  
    9797          try 
    9898          { 
    99                if (empty($_POST['your_pwd']) || !$core->auth->checkPassword($core->auth->crypt($_POST['your_pwd']))) { 
     99               if (empty($_POST['your_pwd']) || !$core->auth->checkPassword($_POST['your_pwd'])) { 
    100100                    throw new Exception(__('Password verification failed')); 
    101101               } 

  • inc/admin/actions/class.dcactionblogs.php

    r3403 r3627  
    155155          } 
    156156 
    157           if (!$core->auth->checkPassword($core->auth->crypt($_POST['pwd']))) { 
     157          if (!$core->auth->checkPassword($_POST['pwd'])) { 
    158158               throw new Exception(__('Password verification failed')); 
    159159          } 

  • inc/admin/lib.moduleslist.php

    r3472 r3627  
    12531253               || !empty($_POST['fetch_pkg']) && !empty($_POST['pkg_url'])) 
    12541254          { 
    1255                if (empty($_POST['your_pwd']) || !$this->core->auth->checkPassword($this->core->auth->crypt($_POST['your_pwd']))) { 
     1255               if (empty($_POST['your_pwd']) || !$this->core->auth->checkPassword($_POST['your_pwd'])) { 
    12561256                    throw new Exception(__('Password verification failed')); 
    12571257               } 
    … …  
    20332033                    || !empty($_POST['fetch_pkg']) && !empty($_POST['pkg_url'])) 
    20342034               { 
    2035                     if (empty($_POST['your_pwd']) || !$this->core->auth->checkPassword($this->core->auth->crypt($_POST['your_pwd']))) { 
     2035                    if (empty($_POST['your_pwd']) || !$this->core->auth->checkPassword($_POST['your_pwd'])) { 
    20362036                         throw new Exception(__('Password verification failed')); 
    20372037                    } 

  • inc/core/class.dc.auth.php

    r3535 r3627  
    121121          if ($pwd != '') 
    122122          { 
    123                if ($this->crypt($pwd) != $rs->user_pwd) { 
    124                     sleep(rand(2,5)); 
    125                     return false; 
     123               $rehash = false; 
     124               if (password_verify($pwd,$rs->user_pwd)) { 
     125                    // User password ok 
     126                    if (password_needs_rehash($rs->user_pwd,PASSWORD_DEFAULT)) { 
     127                         $rs->user_pwd = $this->crypt($pwd); 
     128                         $rehash = true; 
     129                    } 
     130               } else { 
     131                    // Check if pwd still stored in old fashion way 
     132                    $ret = password_get_info($rs->user_pwd); 
     133                    if (is_array($ret) && isset($ret['algo']) && $ret['algo'] == 0) { 
     134                         // hash not done with password_hash() function, check by old fashion way 
     135                         if (crypt::hmac(DC_MASTER_KEY,$pwd,DC_CRYPT_ALGO) == $rs->user_pwd) { 
     136                              // Password Ok, need to store it in new fashion way 
     137                              $rs->user_pwd = $this->crypt($pwd); 
     138                              $rehash = true; 
     139                         } else { 
     140                              // Password KO 
     141                              sleep(rand(2,5)); 
     142                              return false; 
     143                         } 
     144                    } else { 
     145                         // Password KO 
     146                         sleep(rand(2,5)); 
     147                         return false; 
     148                    } 
     149               } 
     150               if ($rehash) { 
     151                    // Store new hash in DB 
     152                    $cur = $this->con->openCursor($this->user_table); 
     153                    $cur->user_pwd = (string) $rs->user_pwd; 
     154                    $cur->update("WHERE user_id = '".$rs->user_id."'"); 
    126155               } 
    127156          } 
    128157          elseif ($user_key != '') 
    129158          { 
    130                if (http::browserUID(DC_MASTER_KEY.$rs->user_id.$rs->user_pwd) != $user_key) { 
     159               if (http::browserUID(DC_MASTER_KEY.$rs->user_id.$this->cryptLegacy($rs->user_id)) != $user_key) { 
    131160                    return false; 
    132161               } 
    … …  
    172201     public function crypt($pwd) 
    173202     { 
     203          return password_hash($pwd,PASSWORD_DEFAULT); 
     204     } 
     205 
     206     /** 
     207      * This method crypt given string (password, session_id, …). 
     208      * 
     209      * @param string $pwd string to be crypted 
     210      * @return string crypted value 
     211      */ 
     212     public function cryptLegacy($pwd) 
     213     { 
    174214          return crypt::hmac(DC_MASTER_KEY,$pwd,DC_CRYPT_ALGO); 
    175215     } 
    … …  
    184224     { 
    185225          if (!empty($this->user_info['user_pwd'])) { 
    186                return $pwd == $this->user_info['user_pwd']; 
     226               return password_verify($pwd,$this->user_info['user_pwd']); 
    187227          } 
    188228 

  • inc/core/class.dc.core.php

    r3565 r3627  
    195195     public function getNonce() 
    196196     { 
    197           return $this->auth->crypt(session_id()); 
     197          return $this->auth->cryptLegacy(session_id()); 
    198198     } 
    199199 
    … …  
    205205          } 
    206206 
    207           return $secret == $this->auth->crypt(session_id()); 
     207          return $secret == $this->auth->cryptLegacy(session_id()); 
    208208     } 
    209209 

  • plugins/antispam/inc/lib.dc.antispam.php

    r3231 r3627  
    134134          $code = 
    135135          pack('a32',$core->auth->userID()). 
    136           pack('H*',$core->auth->crypt($core->auth->getInfo('user_pwd'))); 
     136          pack('H*',$core->auth->cryptLegacy($core->auth->getInfo('user_pwd'))); 
    137137          return bin2hex($code); 
    138138     } 
    … …  
    161161          } 
    162162 
    163           if ($core->auth->crypt($rs->user_pwd) != $pwd) { 
     163          if ($core->auth->cryptLegacy($rs->user_pwd) != $pwd) { 
    164164               return false; 
    165165          } 

  • plugins/importExport/inc/class.dc.import.flat.php

    r3421 r3627  
    9090          if ($full_upl !== null && $this->core->auth->isSuperAdmin()) 
    9191          { 
    92                if (empty($_POST['your_pwd']) || !$this->core->auth->checkPassword($this->core->auth->crypt($_POST['your_pwd']))) { 
     92               if (empty($_POST['your_pwd']) || !$this->core->auth->checkPassword($_POST['your_pwd'])) { 
    9393                    throw new Exception(__('Password verification failed')); 
    9494               } 

  • plugins/pages/page.php

    r3606 r3627  
    539539          $core->url->getURLFor('pagespreview', 
    540540          $core->auth->userID().'/'. 
    541           http::browserUID(DC_MASTER_KEY.$core->auth->userID().$core->auth->getInfo('user_pwd')). 
     541          http::browserUID(DC_MASTER_KEY.$core->auth->userID().$core->auth->cryptLegacy($core->auth->userID())). 
    542542          '/'.$post->post_url); 
    543543          echo '<a id="post-preview" href="'.$preview_url.'" class="button" accesskey="p">'.__('Preview').' (p)'.'</a>'; 
Note: See TracChangeset for help on using the changeset viewer.

Sites map