mirror/php-phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-08-09 02:06:32 +02:00
Code Issues Releases Wiki Activity

Merge pull request #1716 from marc1706/feature/passwords

Browse Source 
[feature/passwords] Add password hashing manager with support for newer hashing algorithms
This commit is contained in:
Nils Adermann
2014-02-02 06:26:35 -08:00
parent cb04252fbd b094c79996
commit f8d6a07392
39 changed files with 1848 additions and 238 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
phpBB/includes/ucp/ucp_profile.php
View File

@@ -82,13 +82,16 @@ class ucp_profile
$error[] = ($data['password_confirm']) ? 'NEW_PASSWORD_ERROR' : 'NEW_PASSWORD_CONFIRM_EMPTY';
}
// Instantiate passwords manager
$passwords_manager = $phpbb_container->get('passwords.manager');
// Only check the new password against the previous password if there have been no errors
if (!sizeof($error) && $auth->acl_get('u_chgpasswd') && $data['new_password'] && phpbb_check_hash($data['new_password'], $user->data['user_password']))
if (!sizeof($error) && $auth->acl_get('u_chgpasswd') && $data['new_password'] && $passwords_manager->check($data['new_password'], $user->data['user_password']))
{
$error[] = 'SAME_PASSWORD_ERROR';
}
if (!phpbb_check_hash($data['cur_password'], $user->data['user_password']))
if (!$passwords_manager->check($data['cur_password'], $user->data['user_password']))
{
$error[] = ($data['cur_password']) ? 'CUR_PASSWORD_ERROR' : 'CUR_PASSWORD_EMPTY';
}
@@ -105,7 +108,7 @@ class ucp_profile
'username_clean' => ($auth->acl_get('u_chgname') && $config['allow_namechange']) ? utf8_clean_string($data['username']) : $user->data['username_clean'],
'user_email' => ($auth->acl_get('u_chgemail')) ? $data['email'] : $user->data['user_email'],
'user_email_hash' => ($auth->acl_get('u_chgemail')) ? phpbb_email_hash($data['email']) : $user->data['user_email_hash'],
'user_password' => ($auth->acl_get('u_chgpasswd') && $data['new_password']) ? phpbb_hash($data['new_password']) : $user->data['user_password'],
'user_password' => ($auth->acl_get('u_chgpasswd') && $data['new_password']) ? $passwords_manager->hash($data['new_password']) : $user->data['user_password'],
'user_passchg' => ($auth->acl_get('u_chgpasswd') && $data['new_password']) ? time() : 0,
);
@@ -114,7 +117,7 @@ class ucp_profile
add_log('user', $user->data['user_id'], 'LOG_USER_UPDATE_NAME', $user->data['username'], $data['username']);
}
if ($auth->acl_get('u_chgpasswd') && $data['new_password'] && !phpbb_check_hash($data['new_password'], $user->data['user_password']))
if ($auth->acl_get('u_chgpasswd') && $data['new_password'] && !$passwords_manager->check($data['new_password'], $user->data['user_password']))
{
$user->reset_login_keys();
add_log('user', $user->data['user_id'], 'LOG_USER_NEW_PASSWORD', $data['username']);

5
phpBB/includes/ucp/ucp_register.php
View File

@@ -294,9 +294,12 @@ class ucp_register
$user_inactive_time = 0;
}
// Instantiate passwords manager
$passwords_manager = $phpbb_container->get('passwords.manager');
$user_row = array(
'username' => $data['username'],
'user_password' => phpbb_hash($data['new_password']),
'user_password' => $passwords_manager->hash($data['new_password']),
'user_email' => $data['email'],
'group_id' => (int) $group_id,
'user_timezone' => $data['tz'],

7
phpBB/includes/ucp/ucp_remind.php
View File

@@ -27,7 +27,7 @@ class ucp_remind
function main($id, $mode)
{
global $config, $phpbb_root_path, $phpEx;
global $db, $user, $auth, $template;
global $db, $user, $auth, $template, $phpbb_container;;
if (!$config['allow_password_reset'])
{
@@ -88,8 +88,11 @@ class ucp_remind
// For the activation key a random length between 6 and 10 will do.
$user_actkey = gen_rand_string(mt_rand(6, 10));
// Instantiate passwords manager
$passwords_manager = $phpbb_container->get('passwords.manager');
$sql = 'UPDATE ' . USERS_TABLE . "
SET user_newpasswd = '" . $db->sql_escape(phpbb_hash($user_password)) . "', user_actkey = '" . $db->sql_escape($user_actkey) . "'
SET user_newpasswd = '" . $db->sql_escape($passwords_manager->hash($user_password)) . "', user_actkey = '" . $db->sql_escape($user_actkey) . "'
WHERE user_id = " . $user_row['user_id'];
$db->sql_query($sql);