Source for file jAuthDriverBase.class.php

Documentation is available at jAuthDriverBase.class.php

  1. <?php
  2. /**
  3. @package    jelix
  4. @subpackage auth_driver
  5. @author      Laurent Jouanneau
  6. @contributor Florian Lonqueu-Brochard
  7. @copyright   2011 Laurent Jouanneau, 2011 Florian Lonqueu-Brochard
  8. @licence  http://www.gnu.org/licenses/lgpl.html GNU Lesser General Public Licence, see LICENCE file
  9. */
  10.  
  11. /**
  12.  * base class for some jAuth drivers
  13.  */
  14. class jAuthDriverBase {
  15.  
  16.     protected $_params;
  17.     protected $passwordHashMethod;
  18.     protected $passwordHashOptions;
  19.  
  20.     function __construct($params){
  21.         $this->_params = $params;
  22.         $this->passwordHashOptions = $params['password_hash_options'];
  23.         $this->passwordHashMethod = $params['password_hash_method'];
  24.     }
  25.  
  26.     /**
  27.      * hash the given password
  28.      * @param string $password the password to hash
  29.      * @return string the hash password
  30.      */
  31.     public function cryptPassword($password$forceOldHash false{
  32.         if (!$forceOldHash && $this->passwordHashMethod{
  33.             return password_hash($password$this->passwordHashMethod$this->passwordHashOptions);
  34.         }
  35.  
  36.         if (isset($this->_params['password_crypt_function'])) {
  37.             $f $this->_params['password_crypt_function'];
  38.             if ($f != ''{
  39.                 if ($f[1== ':'{
  40.                     $t $f[0];
  41.                     $f substr($f2);
  42.                     if ($t == '1'{
  43.                         return $f((isset($this->_params['password_salt'])?$this->_params['password_salt']:'')$password);
  44.                     }
  45.                     else if ($t == '2'{
  46.                         return $f($this->_params$password);
  47.                     }
  48.                 }
  49.                 return $f($password);
  50.             }
  51.         }
  52.         return $password;
  53.     }
  54.  
  55.     /**
  56.      * @param string $givenPassword     the password to verify
  57.      * @param string $currentPasswordHash the hash of the real password
  58.      * @return boolean|stringfalse if password does not correspond. True if it is ok. A string
  59.      *  containing a new hash if it is ok and need to store a new hash
  60.      */
  61.     public function checkPassword($givenPassword$currentPasswordHash{
  62.         if ($currentPasswordHash[0== '$' && $this->passwordHashMethod{
  63.             // ok, we have hash for standard API, let's use standard API
  64.             if (!password_verify($givenPassword$currentPasswordHash)) {
  65.                 return false;
  66.             }
  67.  
  68.             // check if rehash is needed, 
  69.             if (password_needs_rehash($currentPasswordHash$this->passwordHashMethod$this->passwordHashOptions)) {
  70.                 return password_hash($givenPassword$this->passwordHashMethod,  $this->passwordHashOptions);
  71.             }
  72.         }
  73.         else {
  74.             // verify with the old hash api
  75.             if (!hash_equals($currentPasswordHash$this->cryptPassword($givenPasswordtrue))) {
  76.                 return false;
  77.             }
  78.  
  79.             if ($this->passwordHashMethod{
  80.                 // if there is a method to hash with the standard API, let's rehash the password
  81.                 return password_hash($givenPassword$this->passwordHashMethod,  $this->passwordHashOptions);
  82.             }
  83.         }
  84.         return true;
  85.     }
  86. }
  87.  
  88.  
  89. /**
  90.  * function to use to crypt password. use the password_salt value in the config
  91.  * file of the plugin.
  92.  * @deprecated
  93.  */
  94. function sha1WithSalt($salt$password{
  95.     return sha1($salt.':'.$password);
  96. }
  97.  
  98. /**
  99.  * hash password with blowfish algorithm. use the password_salt value in the config file of the plugin
  100.  */
  101. function bcrypt($salt$password$iteration_count 12{
  102.     
  103.     if (CRYPT_BLOWFISH != 1)
  104.         throw new jException('jelix~auth.error.bcrypt.inexistant');
  105.     
  106.     if(empty($salt|| !ctype_alnum($salt|| strlen($salt!= 22)
  107.         throw new jException('jelix~auth.error.bcrypt.bad.salt');
  108.  
  109.     $hash crypt($password'$2a$'.$iteration_count.'$'.$salt.'$');
  110.     
  111.     return substr($hashstrrpos($hash'$')+strlen($salt));
  112.  
  113. }

Documentation generated on Wed, 04 Jan 2017 22:52:15 +0100 by phpDocumentor 1.4.3