mirror/php-phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-08-11 11:13:59 +02:00
Code Issues Releases Wiki Activity

Merge branch '3.3.x'

Browse Source
This commit is contained in:
Máté Bartus
2021-02-05 18:03:51 +01:00
parent ded551812a 1ee1dbb629
commit de711bb7c0
3 changed files with 18 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
phpBB/phpbb/passwords/manager.php
View File

@@ -382,11 +382,22 @@ class manager
* @param array $stored_hash_type An array containing the hash types
* as described by stored password hash
* @param string $hash Stored password hash
* @param bool $skip_phpbb2_check True if phpBB2 password check should be skipped
*
* @return bool True if password is correct, false if not
*/
public function check_combined_hash($password, $stored_hash_type, $hash)
public function check_combined_hash($password, $stored_hash_type, $hash, bool $skip_phpbb2_check = false)
{
// Special case for passwords converted from phpBB2:
// These could be phpass(md5(password)) and hence already be double
// hashed. For these, try to also check combined hash output of
// md5 version of supplied password.
$is_valid_phpbb2_pass = false;
if (!$skip_phpbb2_check)
{
$is_valid_phpbb2_pass = $this->check_combined_hash(md5($password), $stored_hash_type, $hash, true);
}
$i = 0;
$data = array(
'prefix' => '$',
@@ -402,6 +413,7 @@ class manager
$password = str_replace($rebuilt_hash, '', $cur_hash);
$i++;
}
return ($hash === $this->helper->combine_hash_output($data, 'hash', $password));
return hash_equals($hash, $this->helper->combine_hash_output($data, 'hash', $password)) || $is_valid_phpbb2_pass;
}
}