1
0
mirror of https://github.com/phpbb/phpbb.git synced 2025-06-04 21:44:57 +02:00
Marc Alexander ac311e1b39 [ticket/12352] Do not check hashes that don't have the necessary length
This should significantly reduce the time spent on checking hashes of
passwords that should be converted.

PHPBB3-12352
2014-06-02 10:14:26 +02:00

61 lines
1.0 KiB
PHP

<?php
/**
*
* This file is part of the phpBB Forum Software package.
*
* @copyright (c) phpBB Limited <https://www.phpbb.com>
* @license GNU General Public License, version 2 (GPL-2.0)
*
* For full copyright and license information, please see
* the docs/CREDITS.txt file.
*
*/
namespace phpbb\passwords\driver;
class sha1_wcf1 extends base
{
const PREFIX = '$wcf1$';
/**
* @inheritdoc
*/
public function get_prefix()
{
return self::PREFIX;
}
/**
* @inheritdoc
*/
public function is_legacy()
{
return true;
}
/**
* @inheritdoc
*/
public function hash($password, $user_row = '')
{
// Do not support hashing
return false;
}
/**
* @inheritdoc
*/
public function check($password, $hash, $user_row = array())
{
if (empty($hash) || strlen($hash) != 40 || !isset($user_row['user_passwd_salt']))
{
return false;
}
else
{
// Works for standard WCF 1.x, i.e. WBB3 and similar
return $hash === sha1($user_row['user_passwd_salt'] . sha1($user_row['user_passwd_salt'] . sha1($password)));
}
}
}