Code Coverage
 
Classes and Traits
Functions and Methods
Lines
Total
100.00% covered (success)
100.00%
1 / 1
100.00% covered (success)
100.00%
10 / 10
CRAP
100.00% covered (success)
100.00%
141 / 141
manager
100.00% covered (success)
100.00%
1 / 1
100.00% covered (success)
100.00%
10 / 10
44
100.00% covered (success)
100.00%
141 / 141
 __construct
100.00% covered (success)
100.00%
1 / 1
1
100.00% covered (success)
100.00%
5 / 5
 initialize
100.00% covered (success)
100.00%
1 / 1
2
100.00% covered (success)
100.00%
7 / 7
 register_default_type
100.00% covered (success)
100.00%
1 / 1
3
100.00% covered (success)
100.00%
7 / 7
 fill_type_map
100.00% covered (success)
100.00%
1 / 1
3
100.00% covered (success)
100.00%
8 / 8
 get_algorithm
100.00% covered (success)
100.00%
1 / 1
2
100.00% covered (success)
100.00%
4 / 4
 detect_algorithm
100.00% covered (success)
100.00%
1 / 1
7
100.00% covered (success)
100.00%
19 / 19
 hash
100.00% covered (success)
100.00%
1 / 1
8
100.00% covered (success)
100.00%
18 / 18
 check
100.00% covered (success)
100.00%
1 / 1
12
100.00% covered (success)
100.00%
35 / 35
 combined_hash_password
100.00% covered (success)
100.00%
1 / 1
4
100.00% covered (success)
100.00%
24 / 24
 check_combined_hash
100.00% covered (success)
100.00%
1 / 1
2
100.00% covered (success)
100.00%
14 / 14
<?php
/**
*
* This file is part of the phpBB Forum Software package.
*
* @copyright (c) phpBB Limited <https://www.phpbb.com>
* @license GNU General Public License, version 2 (GPL-2.0)
*
* For full copyright and license information, please see
* the docs/CREDITS.txt file.
*
*/
namespace phpbb\passwords;
class manager
{
    /**
    * Default hashing method
    */
    protected $type = false;
    /**
    * Hashing algorithm type map
    * Will be used to map hash prefix to type
    */
    protected $type_map = false;
    /**
    * Service collection of hashing algorithms
    * Needs to be public for passwords helper
    */
    public $algorithms = false;
    /**
    * Password convert flag. Signals that password should be converted
    */
    public $convert_flag = false;
    /**
    * Passwords helper
    * @var \phpbb\passwords\helper
    */
    protected $helper;
    /**
    * phpBB configuration
    * @var \phpbb\config\config
    */
    protected $config;
    /**
     * @var bool Whether or not initialized() has been called
     */
    private $initialized = false;
    /**
     * @var array Hashing driver service collection
     */
    private $hashing_algorithms;
    /**
     * @var array List of default driver types
     */
    private $defaults;
    /**
    * Construct a passwords object
    *
    * @param \phpbb\config\config        $config                phpBB configuration
    * @param array                        $hashing_algorithms    Hashing driver service collection
    * @param \phpbb\passwords\helper    $helper                Passwords helper object
    * @param array                        $defaults            List of default driver types
    */
    public function __construct(\phpbb\config\config $config, $hashing_algorithms, helper $helper, $defaults)
    {
        $this->config = $config;
        $this->helper = $helper;
        $this->hashing_algorithms = $hashing_algorithms;
        $this->defaults = $defaults;
    }
    /**
     * Initialize the internal state
     */
    protected function initialize()
    {
        if (!$this->initialized)
        {
            $this->initialized = true;
            $this->fill_type_map($this->hashing_algorithms);
            $this->register_default_type($this->defaults);
        }
    }
    /**
    * Register default type
    * Will register the first supported type from the list of default types
    *
    * @param array $defaults List of default types in order from first to
    *            use to last to use
    */
    protected function register_default_type($defaults)
    {
        foreach ($defaults as $type)
        {
            if ($this->algorithms[$type]->is_supported())
            {
                $this->type = $this->algorithms[$type]->get_prefix();
                break;
            }
        }
    }
    /**
    * Fill algorithm type map
    *
    * @param \phpbb\di\service_collection $hashing_algorithms
    */
    protected function fill_type_map($hashing_algorithms)
    {
        foreach ($hashing_algorithms as $algorithm)
        {
            if (!isset($this->type_map[$algorithm->get_prefix()]))
            {
                $this->type_map[$algorithm->get_prefix()] = $algorithm;
            }
        }
        $this->algorithms = $hashing_algorithms;
    }
    /**
    * Get the algorithm specified by a specific prefix
    *
    * @param string $prefix Password hash prefix
    *
    * @return object|bool The hash type object or false if prefix is not
    *            supported
    */
    protected function get_algorithm($prefix)
    {
        if (isset($this->type_map[$prefix]))
        {
            return $this->type_map[$prefix];
        }
        else
        {
            return false;
        }
    }
    /**
    * Detect the hash type of the supplied hash
    *
    * @param string $hash Password hash that should be checked
    *
    * @return object|bool The hash type object or false if the specified
    *            type is not supported
    */
    public function detect_algorithm($hash)
    {
        /*
        * preg_match() will also show hashing algos like $2a\H$, which
        * is a combination of bcrypt and phpass. Legacy algorithms
        * like md5 will not be matched by this and need to be treated
        * differently.
        */
        if (!preg_match('#^\$([a-zA-Z0-9\\\]*?)\$#', $hash, $match))
        {
            return false;
        }
        $this->initialize();
        // Be on the lookout for multiple hashing algorithms
        // 2 is correct: H\2a > 2, H\P > 2
        if (strlen($match[1]) > 2 && strpos($match[1], '\\') !== false)
        {
            $hash_types = explode('\\', $match[1]);
            $return_ary = array();
            foreach ($hash_types as $type)
            {
                // we do not support the same hashing
                // algorithm more than once
                if (isset($return_ary[$type]))
                {
                    return false;
                }
                $return_ary[$type] = $this->get_algorithm('$' . $type . '$');
                if (empty($return_ary[$type]))
                {
                    return false;
                }
            }
            return $return_ary;
        }
        // get_algorithm() will automatically return false if prefix
        // is not supported
        return $this->get_algorithm($match[0]);
    }
    /**
    * Hash supplied password
    *
    * @param string $password Password that should be hashed
    * @param string $type Hash type. Will default to standard hash type if
    *            none is supplied
    * @return string|bool Password hash of supplied password or false if
    *            if something went wrong during hashing
    */
    public function hash($password, $type = '')
    {
        if (strlen($password) > 4096)
        {
            // If the password is too huge, we will simply reject it
            // and not let the server try to hash it.
            return false;
        }
        $this->initialize();
        // Try to retrieve algorithm by service name if type doesn't
        // start with dollar sign
        if (!is_array($type) && strpos($type, '$') !== 0 && isset($this->algorithms[$type]))
        {
            $type = $this->algorithms[$type]->get_prefix();
        }
        $type = ($type === '') ? $this->type : $type;
        if (is_array($type))
        {
            return $this->combined_hash_password($password, $type);
        }
        if (isset($this->type_map[$type]))
        {
            $hashing_algorithm = $this->type_map[$type];
        }
        else
        {
            return false;
        }
        return $hashing_algorithm->hash($password);
    }
    /**
    * Check supplied password against hash and set convert_flag if password
    * needs to be converted to different format (preferrably newer one)
    *
    * @param string $password Password that should be checked
    * @param string $hash Stored hash
    * @param array    $user_row User's row in users table
    * @return string|bool True if password is correct, false if not
    */
    public function check($password, $hash, $user_row = array())
    {
        if (strlen($password) > 4096)
        {
            // If the password is too huge, we will simply reject it
            // and not let the server try to hash it.
            return false;
        }
        // Empty hashes can't be checked
        if (empty($hash))
        {
            return false;
        }
        $this->initialize();
        // First find out what kind of hash we're dealing with
        $stored_hash_type = $this->detect_algorithm($hash);
        if ($stored_hash_type == false)
        {
            // Still check MD5 hashes as that is what the installer
            // will default to for the admin user
            return $this->get_algorithm('$H$')->check($password, $hash);
        }
        // Multiple hash passes needed
        if (is_array($stored_hash_type))
        {
            $correct = $this->check_combined_hash($password, $stored_hash_type, $hash);
            $this->convert_flag = ($correct === true) ? true : false;
            return $correct;
        }
        if ($stored_hash_type->get_prefix() !== $this->type)
        {
            $this->convert_flag = true;
        }
        else
        {
            if ($stored_hash_type instanceof driver\rehashable_driver_interface)
            {
                $this->convert_flag = $stored_hash_type->needs_rehash($hash);
            }
            else
            {
                $this->convert_flag = false;
            }
        }
        // Check all legacy hash types if prefix is $CP$
        if ($stored_hash_type->get_prefix() === '$CP$')
        {
            // Remove $CP$ prefix for proper checking
            $hash = substr($hash, 4);
            foreach ($this->type_map as $algorithm)
            {
                if ($algorithm->is_legacy() && $algorithm->check($password, $hash, $user_row) === true)
                {
                    return true;
                }
            }
        }
        return $stored_hash_type->check($password, $hash);
    }
    /**
    * Create combined hash from already hashed password
    *
    * @param string $password_hash Complete current password hash
    * @param string $type Type of the hashing algorithm the password hash
    *        should be combined with
    * @return string|bool Combined password hash if combined hashing was
    *        successful, else false
    */
    public function combined_hash_password($password_hash, $type)
    {
        $this->initialize();
        $data = array(
            'prefix' => '$',
            'settings' => '$',
        );
        $hash_settings = $this->helper->get_combined_hash_settings($password_hash);
        $hash = $hash_settings[0];
        // Put settings of current hash into data array
        $stored_hash_type = $this->detect_algorithm($password_hash);
        $this->helper->combine_hash_output($data, 'prefix', $stored_hash_type->get_prefix());
        $this->helper->combine_hash_output($data, 'settings', $stored_hash_type->get_settings_only($password_hash));
        // Hash current hash with the defined types
        foreach ($type as $cur_type)
        {
            if (isset($this->algorithms[$cur_type]))
            {
                $new_hash_type = $this->algorithms[$cur_type];
            }
            else
            {
                $new_hash_type = $this->get_algorithm($cur_type);
            }
            if (!$new_hash_type)
            {
                return false;
            }
            $new_hash = $new_hash_type->hash(str_replace($stored_hash_type->get_settings_only($password_hash), '', $hash));
            $this->helper->combine_hash_output($data, 'prefix', $new_hash_type->get_prefix());
            $this->helper->combine_hash_output($data, 'settings', substr(str_replace('$', '\\', $new_hash_type->get_settings_only($new_hash, true)), 0));
            $hash = str_replace($new_hash_type->get_settings_only($new_hash), '', $this->helper->obtain_hash_only($new_hash));
        }
        return $this->helper->combine_hash_output($data, 'hash', $hash);
    }
    /**
    * Check combined password hash against the supplied password
    *
    * @param string $password Password entered by user
    * @param array $stored_hash_type An array containing the hash types
    *                as described by stored password hash
    * @param string $hash Stored password hash
    *
    * @return bool True if password is correct, false if not
    */
    public function check_combined_hash($password, $stored_hash_type, $hash)
    {
        $i = 0;
        $data = array(
            'prefix' => '$',
            'settings' => '$',
        );
        $hash_settings = $this->helper->get_combined_hash_settings($hash);
        foreach ($stored_hash_type as $key => $hash_type)
        {
            $rebuilt_hash = $this->helper->rebuild_hash($hash_type->get_prefix(), $hash_settings[$i]);
            $this->helper->combine_hash_output($data, 'prefix', $key);
            $this->helper->combine_hash_output($data, 'settings', $hash_settings[$i]);
            $cur_hash = $hash_type->hash($password, $rebuilt_hash);
            $password = str_replace($rebuilt_hash, '', $cur_hash);
            $i++;
        }
        return ($hash === $this->helper->combine_hash_output($data, 'hash', $password));
    }
}