123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213 |
- <?php
- declare(strict_types=1);
- namespace OC\Security;
- use OCP\IConfig;
- use OCP\Security\IHasher;
- class Hasher implements IHasher {
-
- private array $options = [];
-
- private ?string $legacySalt = null;
- public function __construct(
- private IConfig $config,
- ) {
- if (\defined('PASSWORD_ARGON2ID') || \defined('PASSWORD_ARGON2I')) {
-
-
- $this->options['threads'] = max($this->config->getSystemValueInt('hashingThreads', PASSWORD_ARGON2_DEFAULT_THREADS), 1);
-
- $this->options['memory_cost'] = max($this->config->getSystemValueInt('hashingMemoryCost', PASSWORD_ARGON2_DEFAULT_MEMORY_COST), $this->options['threads'] * 8);
- $this->options['time_cost'] = max($this->config->getSystemValueInt('hashingTimeCost', PASSWORD_ARGON2_DEFAULT_TIME_COST), 1);
- }
- $hashingCost = $this->config->getSystemValue('hashingCost', null);
- if (!\is_null($hashingCost)) {
- $this->options['cost'] = $hashingCost;
- }
- }
-
- public function hash(string $message): string {
- $alg = $this->getPrefferedAlgorithm();
- if (\defined('PASSWORD_ARGON2ID') && $alg === PASSWORD_ARGON2ID) {
- return 3 . '|' . password_hash($message, PASSWORD_ARGON2ID, $this->options);
- }
- if (\defined('PASSWORD_ARGON2I') && $alg === PASSWORD_ARGON2I) {
- return 2 . '|' . password_hash($message, PASSWORD_ARGON2I, $this->options);
- }
- return 1 . '|' . password_hash($message, PASSWORD_BCRYPT, $this->options);
- }
-
- protected function splitHash(string $prefixedHash): ?array {
- $explodedString = explode('|', $prefixedHash, 2);
- if (\count($explodedString) === 2) {
- if ((int)$explodedString[0] > 0) {
- return ['version' => (int)$explodedString[0], 'hash' => $explodedString[1]];
- }
- }
- return null;
- }
-
- protected function legacyHashVerify($message, $hash, &$newHash = null): bool {
- if (empty($this->legacySalt)) {
- $this->legacySalt = $this->config->getSystemValue('passwordsalt', '');
- }
-
- $hashLength = \strlen($hash);
- if (($hashLength === 60 && password_verify($message.$this->legacySalt, $hash)) ||
- ($hashLength === 40 && hash_equals($hash, sha1($message)))) {
- $newHash = $this->hash($message);
- return true;
- }
-
-
- $hashLength = \strlen($hash);
- if (($hashLength === 60 && password_verify($message, $hash)) ||
- ($hashLength === 40 && hash_equals($hash, sha1($message)))) {
- $newHash = $this->hash($message);
- return true;
- }
- return false;
- }
-
- protected function verifyHash(string $message, string $hash, &$newHash = null): bool {
- if (password_verify($message, $hash)) {
- if ($this->needsRehash($hash)) {
- $newHash = $this->hash($message);
- }
- return true;
- }
- return false;
- }
-
- public function verify(string $message, string $hash, &$newHash = null): bool {
- $splittedHash = $this->splitHash($hash);
- if (isset($splittedHash['version'])) {
- switch ($splittedHash['version']) {
- case 3:
- case 2:
- case 1:
- return $this->verifyHash($message, $splittedHash['hash'], $newHash);
- }
- } else {
- return $this->legacyHashVerify($message, $hash, $newHash);
- }
- return false;
- }
- private function needsRehash(string $hash): bool {
- $algorithm = $this->getPrefferedAlgorithm();
- return password_needs_rehash($hash, $algorithm, $this->options);
- }
- private function getPrefferedAlgorithm(): string {
- $default = PASSWORD_BCRYPT;
- if (\defined('PASSWORD_ARGON2I')) {
- $default = PASSWORD_ARGON2I;
- }
- if (\defined('PASSWORD_ARGON2ID')) {
- $default = PASSWORD_ARGON2ID;
- }
-
- if ($this->config->getSystemValueBool('hashing_default_password', false)) {
- $default = PASSWORD_DEFAULT;
- }
- return $default;
- }
- }
|