mirror/php-phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-08-16 13:44:12 +02:00
Code Issues Releases Wiki Activity

Merge remote-tracking branch 'github-marc1706/ticket/12352' into develop-ascraeus

Browse Source 
* github-marc1706/ticket/12352: (33 commits)
  [ticket/12352] Do not check hashes that don't have the necessary length
  [ticket/12352] Update file headers to fit new format
  [ticket/12352] Use custom provider collection for auth providers
  [ticket/12352] Add checks for existing user_pass_convert to migrations
  [ticket/12352] Remove usages of user_pass_convert column
  [ticket/12352] Update schema json file
  [ticket/12352] Remove user_pass_convert column from database
  [ticket/12352] Check each newly added passwords driver in manager_test
  [ticket/12352] Add get_settings_only method to passwords driver base
  [ticket/12352] Add passwords driver for xenforo 1.0, 1.1 passwords
  [ticket/12352] Add tests for wcf1 and wcf2 drivers
  [ticket/12352] Add driver for woltlab community framework 1 passwords
  [ticket/12352] Add driver for woltlab community framework 2 passwords
  [ticket/12352] Add missing $ to md5_mybb and md5_vb driver
  [ticket/12352] Fix spacing in passwords tests
  [ticket/12352] Add passwords driver for vB passwords
  [ticket/12352] Use correct hashing method in md5_mybb driver
  [ticket/12352] Add driver for myBB md5 passwords
  [ticket/12352] Rename phpbb2_md5 driver to fit filenames of other drivers
  [ticket/12352] Add passwords driver for sha1 password hashes
  ...
This commit is contained in:
Nils Adermann
2014-06-11 14:27:57 +02:00
parent e1f371d14a ac311e1b39
commit 694f8391c9
35 changed files with 1335 additions and 113 deletions
Download Patch File Download Diff File Expand all files Collapse all files

71
phpBB/phpbb/auth/provider/db.php
View File

@@ -78,7 +78,7 @@ class db extends \phpbb\auth\provider\base
$username_clean = utf8_clean_string($username);
$sql = 'SELECT user_id, username, user_password, user_passchg, user_pass_convert, user_email, user_type, user_login_attempts
$sql = 'SELECT user_id, username, user_password, user_passchg, user_email, user_type, user_login_attempts
FROM ' . USERS_TABLE . "
WHERE username_clean = '" . $this->db->sql_escape($username_clean) . "'";
$result = $this->db->sql_query($sql);
@@ -170,72 +170,8 @@ class db extends \phpbb\auth\provider\base
}
// If the password convert flag is set we need to convert it
if ($row['user_pass_convert'])
{
// enable super globals to get literal value
// this is needed to prevent unicode normalization
$super_globals_disabled = $this->request->super_globals_disabled();
if ($super_globals_disabled)
{
$this->request->enable_super_globals();
}
// in phpBB2 passwords were used exactly as they were sent, with addslashes applied
$password_old_format = isset($_REQUEST['password']) ? (string) $_REQUEST['password'] : '';
$password_old_format = (!STRIP) ? addslashes($password_old_format) : $password_old_format;
$password_new_format = $this->request->variable('password', '', true);
if ($super_globals_disabled)
{
$this->request->disable_super_globals();
}
if ($password == $password_new_format)
{
if (!function_exists('utf8_to_cp1252'))
{
include($this->phpbb_root_path . 'includes/utf/data/recode_basic.' . $this->php_ext);
}
// cp1252 is phpBB2's default encoding, characters outside ASCII range might work when converted into that encoding
// plain md5 support left in for conversions from other systems.
if ((strlen($row['user_password']) == 34 && ($this->passwords_manager->check(md5($password_old_format), $row['user_password']) || $this->passwords_manager->check(md5(utf8_to_cp1252($password_old_format)), $row['user_password'])))
|| (strlen($row['user_password']) == 32 && (md5($password_old_format) == $row['user_password'] || md5(utf8_to_cp1252($password_old_format)) == $row['user_password'])))
{
$hash = $this->passwords_manager->hash($password_new_format);
// Update the password in the users table to the new format and remove user_pass_convert flag
$sql = 'UPDATE ' . USERS_TABLE . '
SET user_password = \'' . $this->db->sql_escape($hash) . '\',
user_pass_convert = 0
WHERE user_id = ' . $row['user_id'];
$this->db->sql_query($sql);
$row['user_pass_convert'] = 0;
$row['user_password'] = $hash;
}
else
{
// Although we weren't able to convert this password we have to
// increase login attempt count to make sure this cannot be exploited
$sql = 'UPDATE ' . USERS_TABLE . '
SET user_login_attempts = user_login_attempts + 1
WHERE user_id = ' . (int) $row['user_id'] . '
AND user_login_attempts < ' . LOGIN_ATTEMPTS_MAX;
$this->db->sql_query($sql);
return array(
'status' => LOGIN_ERROR_PASSWORD_CONVERT,
'error_msg' => 'LOGIN_ERROR_PASSWORD_CONVERT',
'user_row' => $row,
);
}
}
}
// Check password ...
if (!$row['user_pass_convert'] && $this->passwords_manager->check($password, $row['user_password']))
if ($this->passwords_manager->check($password, $row['user_password']))
{
// Check for old password hash...
if ($this->passwords_manager->convert_flag || strlen($row['user_password']) == 32)
@@ -244,8 +180,7 @@ class db extends \phpbb\auth\provider\base
// Update the password in the users table to the new format
$sql = 'UPDATE ' . USERS_TABLE . "
SET user_password = '" . $this->db->sql_escape($hash) . "',
user_pass_convert = 0
SET user_password = '" . $this->db->sql_escape($hash) . "'
WHERE user_id = {$row['user_id']}";
$this->db->sql_query($sql);

2
phpBB/phpbb/auth/provider/oauth/oauth.php
View File

@@ -215,7 +215,7 @@ class oauth extends \phpbb\auth\provider\base
}
// Retrieve the user's account
$sql = 'SELECT user_id, username, user_password, user_passchg, user_pass_convert, user_email, user_type, user_login_attempts
$sql = 'SELECT user_id, username, user_password, user_passchg, user_email, user_type, user_login_attempts
FROM ' . $this->users_table . '
WHERE user_id = ' . (int) $row['user_id'];
$result = $this->db->sql_query($sql);

65
phpBB/phpbb/auth/provider_collection.php Normal file
View File

@@ -0,0 +1,65 @@
<?php
/**
*
* This file is part of the phpBB Forum Software package.
*
* @copyright (c) phpBB Limited <https://www.phpbb.com>
* @license GNU General Public License, version 2 (GPL-2.0)
*
* For full copyright and license information, please see
* the docs/CREDITS.txt file.
*
*/
namespace phpbb\auth;
use Symfony\Component\DependencyInjection\ContainerInterface;
/**
* Collection of auth providers to be configured at container compile time.
*/
class provider_collection extends \phpbb\di\service_collection
{
/** @var \phpbb\config\config phpBB Config */
protected $config;
/**
* Constructor
*
* @param ContainerInterface $container Container object
* @param \phpbb\config\config $config phpBB config
*/
public function __construct($container, \phpbb\config\config $config)
{
$this->container = $container;
$this->config = $config;
}
/**
* Get an auth provider.
*
* @return object Default auth provider selected in config if it
* does exist. Otherwise the standard db auth
* provider.
* @throws \RuntimeException If neither the auth provider that
* is specified by the phpBB config nor the db
* auth provider exist. The db auth provider
* should always exist in a phpBB installation.
*/
public function get_provider()
{
if ($this->offsetExists('auth.provider.' . basename(trim($this->config['auth_method']))))
{
return $this->offsetGet('auth.provider.' . basename(trim($this->config['auth_method'])));
}
// Revert to db auth provider if selected method does not exist
elseif ($this->offsetExists('auth.provider.db'))
{
return $this->offsetGet('auth.provider.db');
}
else
{
throw new \RuntimeException(sprintf('The authentication provider for the authentication method "%1$s" does not exist. It was not possible to recover from this by reverting to the database authentication provider.', $this->config['auth_method']));
}
}
}

85
phpBB/phpbb/db/migration/data/v310/passwords_convert_p1.php Normal file
View File

@@ -0,0 +1,85 @@
<?php
/**
*
* This file is part of the phpBB Forum Software package.
*
* @copyright (c) phpBB Limited <https://www.phpbb.com>
* @license GNU General Public License, version 2 (GPL-2.0)
*
* For full copyright and license information, please see
* the docs/CREDITS.txt file.
*
*/
namespace phpbb\db\migration\data\v310;
class passwords_convert_p1 extends \phpbb\db\migration\migration
{
static public function depends_on()
{
return array('\phpbb\db\migration\data\v310\passwords_p2');
}
public function update_data()
{
return array(
array('custom', array(array($this, 'update_passwords'))),
);
}
public function update_passwords($start)
{
// Nothing to do if user_pass_convert column doesn't exist
if (!$this->db_tools->sql_column_exists($this->table_prefix . 'users', 'user_pass_convert'))
{
return;
}
$start = (int) $start;
$limit = 1000;
$converted_users = 0;
$sql = 'SELECT user_password, user_id
FROM ' . $this->table_prefix . 'users
WHERE user_pass_convert = 1
GROUP BY user_id
ORDER BY user_id';
$result = $this->db->sql_query_limit($sql, $limit, $start);
$update_users = array();
while ($row = $this->db->sql_fetchrow($result))
{
$converted_users++;
$user_id = (int) $row['user_id'];
// Only prefix passwords without proper prefix
if (!isset($update_users[$user_id]) && !preg_match('#^\$([a-zA-Z0-9\\\]*?)\$#', $row['user_password']))
{
// Use $CP$ prefix for passwords that need to
// be converted and set pass convert to false.
$update_users[$user_id] = array(
'user_password' => '$CP$' . $row['user_password'],
'user_pass_convert' => 0,
);
}
}
$this->db->sql_freeresult($result);
foreach ($update_users as $user_id => $user_data)
{
$sql = 'UPDATE ' . $this->table_prefix . 'users
SET ' . $this->db->sql_build_array('UPDATE', $user_data) . '
WHERE user_id = ' . $user_id;
$this->sql_query($sql);
}
if ($converted_users < $limit)
{
// There are no more users to be converted
return;
}
// There are still more users to query, return the next start value
return $start + $limit;
}
}

49
phpBB/phpbb/db/migration/data/v310/passwords_convert_p2.php Normal file
View File

@@ -0,0 +1,49 @@
<?php
/**
*
* This file is part of the phpBB Forum Software package.
*
* @copyright (c) phpBB Limited <https://www.phpbb.com>
* @license GNU General Public License, version 2 (GPL-2.0)
*
* For full copyright and license information, please see
* the docs/CREDITS.txt file.
*
*/
namespace phpbb\db\migration\data\v310;
class passwords_convert_p2 extends \phpbb\db\migration\migration
{
public function effectively_installed()
{
return !$this->db_tools->sql_column_exists($this->table_prefix . 'users', 'user_pass_convert');
}
static public function depends_on()
{
return array('\phpbb\db\migration\data\v310\passwords_convert_p1');
}
public function update_schema()
{
return array(
'drop_columns' => array(
$this->table_prefix . 'users' => array(
'user_pass_convert',
),
),
);
}
public function revert_schema()
{
return array(
'add_columns' => array(
$this->table_prefix . 'users' => array(
'user_pass_convert' => array('BOOL', 0, 'after' => 'user_passchg'),
),
),
);
}
}

16
phpBB/phpbb/passwords/driver/base.php
View File

@@ -43,4 +43,20 @@ abstract class base implements driver_interface
{
return true;
}
/**
* @inheritdoc
*/
public function is_legacy()
{
return false;
}
/**
* @inheritdoc
*/
public function get_settings_only($hash, $full = false)
{
return false;
}
}

2
phpBB/phpbb/passwords/driver/bcrypt.php
View File

@@ -60,7 +60,7 @@ class bcrypt extends base
/**
* @inheritdoc
*/
public function check($password, $hash)
public function check($password, $hash, $user_row = array())
{
$salt = substr($hash, 0, 29);
if (strlen($salt) != 29)

84
phpBB/phpbb/passwords/driver/bcrypt_wcf2.php Normal file
View File

@@ -0,0 +1,84 @@
<?php
/**
*
* This file is part of the phpBB Forum Software package.
*
* @copyright (c) phpBB Limited <https://www.phpbb.com>
* @license GNU General Public License, version 2 (GPL-2.0)
*
* For full copyright and license information, please see
* the docs/CREDITS.txt file.
*
*/
namespace phpbb\passwords\driver;
class bcrypt_wcf2 extends base
{
const PREFIX = '$wcf2$';
/** @var \phpbb\passwords\driver\bcrypt */
protected $bcrypt;
/** @var phpbb\passwords\driver\helper */
protected $helper;
/**
* Constructor of passwords driver object
*
* @param \phpbb\passwords\driver\bcrypt $bcrypt Salted md5 driver
* @param \phpbb\passwords\driver\helper $helper Password driver helper
*/
public function __construct(\phpbb\passwords\driver\bcrypt $bcrypt, helper $helper)
{
$this->bcrypt = $bcrypt;
$this->helper = $helper;
}
/**
* @inheritdoc
*/
public function get_prefix()
{
return self::PREFIX;
}
/**
* @inheritdoc
*/
public function is_legacy()
{
return true;
}
/**
* @inheritdoc
*/
public function hash($password, $user_row = '')
{
// Do not support hashing
return false;
}
/**
* @inheritdoc
*/
public function check($password, $hash, $user_row = array())
{
if (empty($hash) || strlen($hash) != 60)
{
return false;
}
else
{
$salt = substr($hash, 0, 29);
if (strlen($salt) != 29)
{
return false;
}
// Works for standard WCF 2.x, i.e. WBB4 and similar
return $hash === $this->bcrypt->hash($this->bcrypt->hash($password, $salt), $salt);
}
}
}

43
phpBB/phpbb/passwords/driver/convert_password.php Normal file
View File

@@ -0,0 +1,43 @@
<?php
/**
*
* This file is part of the phpBB Forum Software package.
*
* @copyright (c) phpBB Limited <https://www.phpbb.com>
* @license GNU General Public License, version 2 (GPL-2.0)
*
* For full copyright and license information, please see
* the docs/CREDITS.txt file.
*
*/
namespace phpbb\passwords\driver;
class convert_password extends base
{
const PREFIX = '$CP$';
/**
* @inheritdoc
*/
public function get_prefix()
{
return self::PREFIX;
}
/**
* @inheritdoc
*/
public function hash($password, $user_row = '')
{
return false;
}
/**
* @inheritdoc
*/
public function check($password, $hash, $user_row = array())
{
return false;
}
}

10
phpBB/phpbb/passwords/driver/driver_interface.php
View File

@@ -22,6 +22,13 @@ interface driver_interface
*/
public function is_supported();
/**
* Check if hash type is a legacy hash type
*
* @return bool True if it's a legacy hash type, false if not
*/
public function is_legacy();
/**
* Returns the hash prefix
*
@@ -44,10 +51,11 @@ interface driver_interface
*
* @param string $password The password to check
* @param string $hash The password hash to check against
* @param string $user_row User's row in users table
*
* @return bool True if password is correct, else false
*/
public function check($password, $hash);
public function check($password, $hash, $user_row = array());
/**
* Get only the settings of the specified hash

60
phpBB/phpbb/passwords/driver/md5_mybb.php Normal file
View File

@@ -0,0 +1,60 @@
<?php
/**
*
* This file is part of the phpBB Forum Software package.
*
* @copyright (c) phpBB Limited <https://www.phpbb.com>
* @license GNU General Public License, version 2 (GPL-2.0)
*
* For full copyright and license information, please see
* the docs/CREDITS.txt file.
*
*/
namespace phpbb\passwords\driver;
class md5_mybb extends base
{
const PREFIX = '$md5_mybb$';
/**
* @inheritdoc
*/
public function get_prefix()
{
return self::PREFIX;
}
/**
* @inheritdoc
*/
public function is_legacy()
{
return true;
}
/**
* @inheritdoc
*/
public function hash($password, $user_row = '')
{
// Do not support hashing
return false;
}
/**
* @inheritdoc
*/
public function check($password, $hash, $user_row = array())
{
if (empty($hash) || strlen($hash) != 32 || !isset($user_row['user_passwd_salt']))
{
return false;
}
else
{
// Works for myBB 1.1.x, 1.2.x, 1.4.x, 1.6.x
return $hash === md5(md5($user_row['user_passwd_salt']) . md5($password));
}
}
}

118
phpBB/phpbb/passwords/driver/md5_phpbb2.php Normal file
View File

@@ -0,0 +1,118 @@
<?php
/**
*
* This file is part of the phpBB Forum Software package.
*
* @copyright (c) phpBB Limited <https://www.phpbb.com>
* @license GNU General Public License, version 2 (GPL-2.0)
*
* For full copyright and license information, please see
* the docs/CREDITS.txt file.
*
*/
namespace phpbb\passwords\driver;
class md5_phpbb2 extends base
{
const PREFIX = '$md5_phpbb2$';
/** @var \phpbb\request\request phpBB request object */
protected $request;
/** @var \phpbb\passwords\driver\salted_md5 */
protected $salted_md5;
/** @var phpBB root path */
protected $phpbb_root_path;
/** @var php file extension */
protected $php_ext;
/**
* Constructor of passwords driver object
*
* @param \phpbb\request\request $request phpBB request object
* @param \phpbb\passwords\driver\salted_md5 $salted_md5 Salted md5 driver
* @param string $phpbb_root_path phpBB root path
* @param string $php_ext PHP file extension
*/
public function __construct($request, \phpbb\passwords\driver\salted_md5 $salted_md5, $phpbb_root_path, $php_ext)
{
$this->request = $request;
$this->salted_md5 = $salted_md5;
$this->phpbb_root_path = $phpbb_root_path;
$this->php_ext = $php_ext;
}
/**
* @inheritdoc
*/
public function get_prefix()
{
return self::PREFIX;
}
/**
* @inheritdoc
*/
public function is_legacy()
{
return true;
}
/**
* @inheritdoc
*/
public function hash($password, $user_row = '')
{
// Do not support hashing
return false;
}
/**
* @inheritdoc
*/
public function check($password, $hash, $user_row = array())
{
if (strlen($hash) != 32 && strlen($hash) != 34)
{
return false;
}
// enable super globals to get literal value
// this is needed to prevent unicode normalization
$super_globals_disabled = $this->request->super_globals_disabled();
if ($super_globals_disabled)
{
$this->request->enable_super_globals();
}
// in phpBB2 passwords were used exactly as they were sent, with addslashes applied
$password_old_format = isset($_REQUEST['password']) ? (string) $_REQUEST['password'] : '';
$password_old_format = (!STRIP) ? addslashes($password_old_format) : $password_old_format;
$password_new_format = $this->request->variable('password', '', true);
if ($super_globals_disabled)
{
$this->request->disable_super_globals();
}
if ($password == $password_new_format)
{
if (!function_exists('utf8_to_cp1252'))
{
include($this->phpbb_root_path . 'includes/utf/data/recode_basic.' . $this->php_ext);
}
if (md5($password_old_format) === $hash || md5(\utf8_to_cp1252($password_old_format)) === $hash
|| $this->salted_md5->check(md5($password_old_format), $hash) === true
|| $this->salted_md5->check(md5(\utf8_to_cp1252($password_old_format)), $hash) === true)
{
return true;
}
}
return false;
}
}

60
phpBB/phpbb/passwords/driver/md5_vb.php Normal file
View File

@@ -0,0 +1,60 @@
<?php
/**
*
* This file is part of the phpBB Forum Software package.
*
* @copyright (c) phpBB Limited <https://www.phpbb.com>
* @license GNU General Public License, version 2 (GPL-2.0)
*
* For full copyright and license information, please see
* the docs/CREDITS.txt file.
*
*/
namespace phpbb\passwords\driver;
class md5_vb extends base
{
const PREFIX = '$md5_vb$';
/**
* @inheritdoc
*/
public function get_prefix()
{
return self::PREFIX;
}
/**
* @inheritdoc
*/
public function is_legacy()
{
return true;
}
/**
* @inheritdoc
*/
public function hash($password, $user_row = '')
{
// Do not support hashing
return false;
}
/**
* @inheritdoc
*/
public function check($password, $hash, $user_row = array())
{
if (empty($hash) || strlen($hash) != 32 || !isset($user_row['user_passwd_salt']))
{
return false;
}
else
{
// Works for vB 3.8.x, 4.x.x, 5.0.x
return $hash === md5(md5($password) . $user_row['user_passwd_salt']);
}
}
}

10
phpBB/phpbb/passwords/driver/salted_md5.php
View File

@@ -53,6 +53,14 @@ class salted_md5 extends base
return self::PREFIX;
}
/**
* @inheritdoc
*/
public function is_legacy()
{
return true;
}
/**
* @inheritdoc
*/
@@ -92,7 +100,7 @@ class salted_md5 extends base
/**
* @inheritdoc
*/
public function check($password, $hash)
public function check($password, $hash, $user_row = array())
{
if (strlen($hash) !== 34)
{

52
phpBB/phpbb/passwords/driver/sha1.php Normal file
View File

@@ -0,0 +1,52 @@
<?php
/**
*
* This file is part of the phpBB Forum Software package.
*
* @copyright (c) phpBB Limited <https://www.phpbb.com>
* @license GNU General Public License, version 2 (GPL-2.0)
*
* For full copyright and license information, please see
* the docs/CREDITS.txt file.
*
*/
namespace phpbb\passwords\driver;
class sha1 extends base
{
const PREFIX = '$sha1$';
/**
* @inheritdoc
*/
public function get_prefix()
{
return self::PREFIX;
}
/**
* @inheritdoc
*/
public function is_legacy()
{
return true;
}
/**
* @inheritdoc
*/
public function hash($password, $user_row = '')
{
// Do not support hashing
return false;
}
/**
* @inheritdoc
*/
public function check($password, $hash, $user_row = array())
{
return (strlen($hash) == 40) ? $hash === sha1($password) : false;
}
}

51
phpBB/phpbb/passwords/driver/sha1_smf.php Normal file
View File

@@ -0,0 +1,51 @@
<?php
/**
*
* This file is part of the phpBB Forum Software package.
*
* @copyright (c) phpBB Limited <https://www.phpbb.com>
* @license GNU General Public License, version 2 (GPL-2.0)
*
* For full copyright and license information, please see
* the docs/CREDITS.txt file.
*
*/
namespace phpbb\passwords\driver;
class sha1_smf extends base
{
const PREFIX = '$smf$';
/**
* @inheritdoc
*/
public function get_prefix()
{
return self::PREFIX;
}
/**
* @inheritdoc
*/
public function is_legacy()
{
return true;
}
/**
* @inheritdoc
*/
public function hash($password, $user_row = '')
{
return (isset($user_row['login_name'])) ? sha1(strtolower($user_row['login_name']) . $password) : false;
}
/**
* @inheritdoc
*/
public function check($password, $hash, $user_row = array())
{
return (strlen($hash) == 40) ? $hash === $this->hash($password, $user_row) : false;
}
}

60
phpBB/phpbb/passwords/driver/sha1_wcf1.php Normal file
View File

@@ -0,0 +1,60 @@
<?php
/**
*
* This file is part of the phpBB Forum Software package.
*
* @copyright (c) phpBB Limited <https://www.phpbb.com>
* @license GNU General Public License, version 2 (GPL-2.0)
*
* For full copyright and license information, please see
* the docs/CREDITS.txt file.
*
*/
namespace phpbb\passwords\driver;
class sha1_wcf1 extends base
{
const PREFIX = '$wcf1$';
/**
* @inheritdoc
*/
public function get_prefix()
{
return self::PREFIX;
}
/**
* @inheritdoc
*/
public function is_legacy()
{
return true;
}
/**
* @inheritdoc
*/
public function hash($password, $user_row = '')
{
// Do not support hashing
return false;
}
/**
* @inheritdoc
*/
public function check($password, $hash, $user_row = array())
{
if (empty($hash) || strlen($hash) != 40 || !isset($user_row['user_passwd_salt']))
{
return false;
}
else
{
// Works for standard WCF 1.x, i.e. WBB3 and similar
return $hash === sha1($user_row['user_passwd_salt'] . sha1($user_row['user_passwd_salt'] . sha1($password)));
}
}
}

68
phpBB/phpbb/passwords/driver/sha_xf1.php Normal file
View File

@@ -0,0 +1,68 @@
<?php
/**
*
* This file is part of the phpBB Forum Software package.
*
* @copyright (c) phpBB Limited <https://www.phpbb.com>
* @license GNU General Public License, version 2 (GPL-2.0)
*
* For full copyright and license information, please see
* the docs/CREDITS.txt file.
*
*/
namespace phpbb\passwords\driver;
class sha_xf1 extends base
{
const PREFIX = '$xf1$';
/**
* @inheritdoc
*/
public function get_prefix()
{
return self::PREFIX;
}
/**
* @inheritdoc
*/
public function is_legacy()
{
return true;
}
/**
* @inheritdoc
*/
public function hash($password, $user_row = '')
{
// Do not support hashing
return false;
}
/**
* @inheritdoc
*/
public function check($password, $hash, $user_row = array())
{
if (empty($hash) || (strlen($hash) != 40 && strlen($hash) != 64) || !isset($user_row['user_passwd_salt']))
{
return false;
}
else
{
// Works for xenforo 1.0, 1.1
if ($hash === sha1(sha1($password) . $user_row['user_passwd_salt'])
|| $hash === hash('sha256', hash('sha256', $password) . $user_row['user_passwd_salt']))
{
return true;
}
else
{
return false;
}
}
}
}

30
phpBB/phpbb/passwords/manager.php
View File

@@ -141,7 +141,7 @@ class manager
*/
if (!preg_match('#^\$([a-zA-Z0-9\\\]*?)\$#', $hash, $match))
{
return $this->get_algorithm('$H$');
return false;
}
// Be on the lookout for multiple hashing algorithms
@@ -224,9 +224,10 @@ class manager
*
* @param string $password Password that should be checked
* @param string $hash Stored hash
* @param array $user_row User's row in users table
* @return string|bool True if password is correct, false if not
*/
public function check($password, $hash)
public function check($password, $hash, $user_row = array())
{
if (strlen($password) > 4096)
{
@@ -235,11 +236,19 @@ class manager
return false;
}
// Empty hashes can't be checked
if (empty($hash))
{
return false;
}
// First find out what kind of hash we're dealing with
$stored_hash_type = $this->detect_algorithm($hash);
if ($stored_hash_type == false)
{
return false;
// Still check MD5 hashes as that is what the installer
// will default to for the admin user
return $this->get_algorithm('$H$')->check($password, $hash);
}
// Multiple hash passes needed
@@ -259,6 +268,21 @@ class manager
$this->convert_flag = false;
}
// Check all legacy hash types if prefix is $CP$
if ($stored_hash_type->get_prefix() === '$CP$')
{
// Remove $CP$ prefix for proper checking
$hash = substr($hash, 4);
foreach ($this->type_map as $algorithm)
{
if ($algorithm->is_legacy() && $algorithm->check($password, $hash, $user_row) === true)
{
return true;
}
}
}
return $stored_hash_type->check($password, $hash);
}

15
phpBB/phpbb/session.php
View File

@@ -408,9 +408,8 @@ class session
$session_expired = false;
// Check whether the session is still valid if we have one
$method = basename(trim($config['auth_method']));
$provider = $phpbb_container->get('auth.provider.' . $method);
$provider_collection = $phpbb_container->get('auth.provider_collection');
$provider = $provider_collection->get_provider();
if (!($provider instanceof \phpbb\auth\provider\provider_interface))
{
@@ -577,9 +576,8 @@ class session
}
}
$method = basename(trim($config['auth_method']));
$provider = $phpbb_container->get('auth.provider.' . $method);
$provider_collection = $phpbb_container->get('auth.provider_collection');
$provider = $provider_collection->get_provider();
$this->data = $provider->autologin();
if (sizeof($this->data))
@@ -898,9 +896,8 @@ class session
$db->sql_query($sql);
// Allow connecting logout with external auth method logout
$method = basename(trim($config['auth_method']));
$provider = $phpbb_container->get('auth.provider.' . $method);
$provider_collection = $phpbb_container->get('auth.provider_collection');
$provider = $provider_collection->get_provider();
$provider->logout($this->data, $new_session);
if ($this->data['user_id'] != ANONYMOUS)