2012-08-08 13:51:54 +01:00
|
|
|
<?php
|
|
|
|
/**
|
|
|
|
* StatusNet, the distributed open-source microblogging tool
|
|
|
|
*
|
|
|
|
* Plugin to use crypt() for user password hashes
|
|
|
|
*
|
|
|
|
* PHP version 5
|
|
|
|
*
|
|
|
|
* LICENCE: This program is free software: you can redistribute it and/or modify
|
|
|
|
* it under the terms of the GNU Affero General Public License as published by
|
|
|
|
* the Free Software Foundation, either version 3 of the License, or
|
|
|
|
* (at your option) any later version.
|
|
|
|
*
|
|
|
|
* This program is distributed in the hope that it will be useful,
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
* GNU Affero General Public License for more details.
|
|
|
|
*
|
|
|
|
* You should have received a copy of the GNU Affero General Public License
|
|
|
|
* along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
*
|
|
|
|
* @category Plugin
|
2013-10-17 15:32:53 +01:00
|
|
|
* @package GNUsocial
|
2012-08-08 13:51:54 +01:00
|
|
|
* @author Mikael Nordfeldth <mmn@hethane.se>
|
|
|
|
* @copyright 2012 StatusNet, Inc.
|
2013-10-17 15:32:53 +01:00
|
|
|
* @copyright 2013 Free Software Foundation, Inc http://www.fsf.org
|
2012-08-08 13:51:54 +01:00
|
|
|
* @license http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
|
2013-10-17 15:32:53 +01:00
|
|
|
* @link http://www.gnu.org/software/social/
|
2012-08-08 13:51:54 +01:00
|
|
|
*/
|
|
|
|
|
2013-10-17 15:32:53 +01:00
|
|
|
if (!defined('GNUSOCIAL')) { exit(1); }
|
2012-08-08 13:51:54 +01:00
|
|
|
|
|
|
|
class AuthCryptPlugin extends AuthenticationPlugin
|
|
|
|
{
|
2019-06-03 01:56:52 +01:00
|
|
|
const PLUGIN_VERSION = '2.0.0';
|
2013-10-17 15:32:53 +01:00
|
|
|
protected $hash = '$6$'; // defaults to SHA512, i.e. '$6$', in onInitializePlugin()
|
|
|
|
protected $statusnet = true; // if true, also check StatusNet style password hash
|
|
|
|
protected $overwrite = true; // if true, password change means overwrite with crypt()
|
2018-03-12 02:39:47 +00:00
|
|
|
protected $argon = false; // Use Argon if supported.
|
2013-10-17 15:32:53 +01:00
|
|
|
|
2018-03-12 01:28:24 +00:00
|
|
|
public $provider_name = 'password_hash'; // not actually used
|
2012-08-08 13:51:54 +01:00
|
|
|
|
|
|
|
/*
|
|
|
|
* FUNCTIONALITY
|
|
|
|
*/
|
|
|
|
|
2013-10-17 15:32:53 +01:00
|
|
|
function checkPassword($username, $password)
|
|
|
|
{
|
2015-02-25 23:45:17 +00:00
|
|
|
$username = Nickname::normalize($username);
|
|
|
|
|
2013-10-17 15:32:53 +01:00
|
|
|
$user = User::getKV('nickname', $username);
|
|
|
|
if (!($user instanceof User)) {
|
|
|
|
return false;
|
|
|
|
}
|
2012-08-08 13:51:54 +01:00
|
|
|
|
2013-10-21 12:16:03 +01:00
|
|
|
// crypt understands what the salt part of $user->password is
|
2013-10-17 15:32:53 +01:00
|
|
|
if ($user->password === crypt($password, $user->password)) {
|
2018-03-12 01:28:24 +00:00
|
|
|
// and update password hash entry to password_hash() compatible
|
2018-03-19 03:21:03 +00:00
|
|
|
if ($this->overwrite) {
|
2018-03-12 01:28:24 +00:00
|
|
|
$this->changePassword($user->nickname, null, $password);
|
|
|
|
}
|
2012-08-08 13:51:54 +01:00
|
|
|
return $user;
|
|
|
|
}
|
2013-10-17 15:32:53 +01:00
|
|
|
|
|
|
|
// If we check StatusNet hash, for backwards compatibility and migration
|
|
|
|
if ($this->statusnet && $user->password === md5($password . $user->id)) {
|
|
|
|
// and update password hash entry to crypt() compatible
|
2018-03-19 03:21:03 +00:00
|
|
|
if ($this->overwrite) {
|
2013-10-17 15:32:53 +01:00
|
|
|
$this->changePassword($user->nickname, null, $password);
|
|
|
|
}
|
2012-08-08 13:51:54 +01:00
|
|
|
return $user;
|
|
|
|
}
|
|
|
|
|
2018-03-19 03:21:03 +00:00
|
|
|
// Timing safe password verification on supported PHP versions
|
|
|
|
if (password_verify($password, $user->password)) {
|
|
|
|
return $user;
|
|
|
|
}
|
|
|
|
|
2012-08-08 13:51:54 +01:00
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
2013-10-21 12:16:03 +01:00
|
|
|
protected function cryptSalt($len=CRYPT_SALT_LENGTH)
|
|
|
|
{
|
|
|
|
$chars = "./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
|
|
|
|
$salt = '';
|
|
|
|
|
|
|
|
for ($i=0; $i<$len; $i++) {
|
|
|
|
$salt .= $chars{mt_rand(0, strlen($chars)-1)};
|
|
|
|
}
|
|
|
|
|
|
|
|
return $salt;
|
|
|
|
}
|
|
|
|
|
2012-08-08 13:51:54 +01:00
|
|
|
// $oldpassword is already verified when calling this function... shouldn't this be private?!
|
2013-10-17 15:32:53 +01:00
|
|
|
function changePassword($username, $oldpassword, $newpassword)
|
|
|
|
{
|
2015-02-25 23:45:17 +00:00
|
|
|
$username = Nickname::normalize($username);
|
|
|
|
|
2018-03-19 03:21:03 +00:00
|
|
|
if($this->overwrite == false) {
|
2012-08-08 13:51:54 +01:00
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
2013-08-18 12:04:58 +01:00
|
|
|
$user = User::getKV('nickname', $username);
|
2012-08-08 13:51:54 +01:00
|
|
|
if (empty($user)) {
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
$original = clone($user);
|
|
|
|
|
2013-10-17 15:32:53 +01:00
|
|
|
$user->password = $this->hashPassword($newpassword, $user->getProfile());
|
2012-08-08 13:51:54 +01:00
|
|
|
|
|
|
|
return (true === $user->validate() && $user->update($original));
|
|
|
|
}
|
|
|
|
|
2013-10-17 15:32:53 +01:00
|
|
|
public function hashPassword($password, Profile $profile=null)
|
|
|
|
{
|
2018-03-19 03:21:03 +00:00
|
|
|
$algorithm = PASSWORD_DEFAULT;
|
|
|
|
$options = ['cost' => 12];
|
|
|
|
|
|
|
|
if($this->argon == true && version_compare(PHP_VERSION, '7.2.0') == 1) {
|
|
|
|
$algorithm = PASSWORD_ARGON2I;
|
|
|
|
$options = [
|
|
|
|
'memory_cost' => PASSWORD_ARGON2_DEFAULT_MEMORY_COST,
|
|
|
|
'time_cost' => PASSWORD_ARGON2_DEFAULT_TIME_COST,
|
|
|
|
'threads' => PASSWORD_ARGON2_DEFAULT_THREADS
|
|
|
|
];
|
2018-03-12 01:28:24 +00:00
|
|
|
}
|
2018-03-19 03:21:03 +00:00
|
|
|
// Use the modern password hashing algorithm
|
|
|
|
// http://php.net/manual/en/function.password-hash.php
|
|
|
|
// Uses PASSWORD_BCRYPT by default, with PASSWORD_ARGON2I being the next possible default in future versions
|
|
|
|
return password_hash($password, $algorithm, $options);
|
2013-10-17 15:32:53 +01:00
|
|
|
}
|
|
|
|
|
2012-08-08 13:51:54 +01:00
|
|
|
/*
|
|
|
|
* EVENTS
|
|
|
|
*/
|
|
|
|
|
2015-07-17 00:47:43 +01:00
|
|
|
public function onStartChangePassword(Profile $target, $oldpassword, $newpassword)
|
2013-10-17 15:32:53 +01:00
|
|
|
{
|
2015-07-17 00:47:43 +01:00
|
|
|
if (!$this->checkPassword($target->getNickname(), $oldpassword)) {
|
2012-08-08 13:51:54 +01:00
|
|
|
// if we ARE in overwrite mode, test password with common_check_user
|
2015-07-17 00:47:43 +01:00
|
|
|
if (!$this->overwrite || !common_check_user($target->getNickname(), $oldpassword)) {
|
2012-08-08 13:51:54 +01:00
|
|
|
// either we're not in overwrite mode, or the password was incorrect
|
|
|
|
return !$this->authoritative;
|
|
|
|
}
|
|
|
|
// oldpassword was apparently ok
|
|
|
|
}
|
2015-07-17 00:47:43 +01:00
|
|
|
$changed = $this->changePassword($target->getNickname(), $oldpassword, $newpassword);
|
2012-08-08 13:51:54 +01:00
|
|
|
|
2013-10-17 15:32:53 +01:00
|
|
|
return (!$changed && empty($this->authoritative));
|
2012-08-08 13:51:54 +01:00
|
|
|
}
|
|
|
|
|
2013-10-17 15:32:53 +01:00
|
|
|
public function onStartCheckPassword($nickname, $password, &$authenticatedUser)
|
|
|
|
{
|
2012-08-08 13:51:54 +01:00
|
|
|
$authenticatedUser = $this->checkPassword($nickname, $password);
|
2013-10-17 15:32:53 +01:00
|
|
|
// if we failed, only return false to stop plugin execution if we're authoritative
|
|
|
|
return (!($authenticatedUser instanceof User) && empty($this->authoritative));
|
2012-08-08 13:51:54 +01:00
|
|
|
}
|
|
|
|
|
2013-10-17 15:32:53 +01:00
|
|
|
public function onStartHashPassword(&$hashed, $password, Profile $profile=null)
|
|
|
|
{
|
|
|
|
$hashed = $this->hashPassword($password, $profile);
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
|
|
|
public function onCheckSchema()
|
|
|
|
{
|
2012-08-08 13:51:54 +01:00
|
|
|
// we only use the User database, so default AuthenticationPlugin stuff can be ignored
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
2013-10-17 15:32:53 +01:00
|
|
|
public function onUserDeleteRelated($user, &$tables)
|
|
|
|
{
|
2012-08-08 13:51:54 +01:00
|
|
|
// not using User_username table, so no need to add it here.
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
2015-06-06 21:04:01 +01:00
|
|
|
public function onPluginVersion(array &$versions)
|
2012-08-08 13:51:54 +01:00
|
|
|
{
|
|
|
|
$versions[] = array('name' => 'AuthCrypt',
|
2019-06-03 01:56:52 +01:00
|
|
|
'version' => self::PLUGIN_VERSION,
|
2012-08-08 13:51:54 +01:00
|
|
|
'author' => 'Mikael Nordfeldth',
|
2016-01-22 16:38:42 +00:00
|
|
|
'homepage' => 'https://git.gnu.io/gnu/gnu-social/tree/master/plugins/AuthCrypt',
|
2012-08-08 13:51:54 +01:00
|
|
|
'rawdescription' =>
|
|
|
|
// TRANS: Plugin description.
|
|
|
|
_m('Authentication and password hashing with crypt()'));
|
|
|
|
return true;
|
|
|
|
}
|
2018-03-19 03:21:03 +00:00
|
|
|
}
|