diogo/symfony
Archived
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[Security\Core] Make SodiumPasswordEncoder validate BCrypt-ed passwords

Browse Source
This commit is contained in:
Nicolas Grekas 2019-05-31 11:10:50 +02:00
parent 89f423fc35
commit c0fc45682a
2 changed files with 11 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/Symfony/Component/Security/Core/Encoder/SodiumPasswordEncoder.php
View File

@ -84,6 +84,11 @@ final class SodiumPasswordEncoder implements PasswordEncoderInterface, SelfSalti
return false;
}
if (72 >= \strlen($raw) && 0 === strpos($encoded, '$2')) {
// Accept validating BCrypt passwords for seamless migrations
return password_verify($raw, $encoded);
}
if (\function_exists('sodium_crypto_pwhash_str_verify')) {
return \sodium_crypto_pwhash_str_verify($encoded, $raw);
}

6
src/Symfony/Component/Security/Core/Tests/Encoder/SodiumPasswordEncoderTest.php
View File

@ -31,6 +31,12 @@ class SodiumPasswordEncoderTest extends TestCase
$this->assertFalse($encoder->isPasswordValid($result, 'anotherPassword', null));
}
public function testBCryptValidation()
{
$encoder = new SodiumPasswordEncoder();
$this->assertTrue($encoder->isPasswordValid('$2y$04$M8GDODMoGQLQRpkYCdoJh.lbiZPee3SZI32RcYK49XYTolDGwoRMm', 'abc', null));
}
/**
* @expectedException \Symfony\Component\Security\Core\Exception\BadCredentialsException
*/