includes/password/BcryptPassword.php

   1 <?php
   2 /**
   3  * Implements the BcryptPassword class for the MediaWiki software.
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation; either version 2 of the License, or
   8  * (at your option) any later version.
   9  *
  10  * This program is distributed in the hope that it will be useful,
  11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  13  * GNU General Public License for more details.
  14  *
  15  * You should have received a copy of the GNU General Public License along
  16  * with this program; if not, write to the Free Software Foundation, Inc.,
  17  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  18  * http://www.gnu.org/copyleft/gpl.html
  19  *
  20  * @file
  21  */
  22
  23 declare( strict_types = 1 );
  24
  25 namespace MediaWiki\Password;
  26
  27 use RuntimeException;
  28
  29 /**
  30  * A Bcrypt-hashed password
  31  *
  32  * This is a computationally complex password hash for use in modern applications.
  33  * The number of rounds can be configured by $wgPasswordConfig['bcrypt']['cost'].
  34  *
  35  * @since 1.24
  36  */
  37 class BcryptPassword extends ParameterizedPassword {
  38         protected function getDefaultParams(): array {
  39                 return [
  40                         'rounds' => $this->config['cost'],
  41                 ];
  42         }
  43
  44         protected function getDelimiter(): string {
  45                 return '$';
  46         }
  47
  48         protected function parseHash( ?string $hash ): void {
  49                 parent::parseHash( $hash );
  50
  51                 $this->params['rounds'] = (int)$this->params['rounds'];
  52         }
  53
  54         /**
  55          * @note Callers should make sure that bcrypt is available before calling this method.
  56          *
  57          * @param string $password Password to encrypt
  58          *
  59          * @throws PasswordError If bcrypt has an unknown error
  60          */
  61         public function crypt( string $password ): void {
  62                 if ( !defined( 'CRYPT_BLOWFISH' ) ) {
  63                         throw new RuntimeException( 'Bcrypt is not supported.' );
  64                 }
  65
  66                 // Either use existing hash or make a new salt
  67                 // Bcrypt expects 22 characters of base64-encoded salt
  68                 // Note: bcrypt does not use MIME base64. It uses its own base64 without any '=' padding.
  69                 //       It expects a 128 bit salt, so it will ignore anything after the first 128 bits
  70                 if ( !isset( $this->args[0] ) ) {
  71                         $this->args[] = substr(
  72                                 // Replace + with ., because bcrypt uses a non-MIME base64 format
  73                                 strtr(
  74                                         // Random base64 encoded string
  75                                         base64_encode( random_bytes( 16 ) ),
  76                                         '+', '.'
  77                                 ),
  78                                 0, 22
  79                         );
  80                 }
  81
  82                 $hash = crypt( $password,
  83                         sprintf( '$2y$%02d$%s', (int)$this->params['rounds'], $this->args[0] ) );
  84
  85                 if ( strlen( $hash ) <= 13 ) {
  86                         throw new PasswordError( 'Error when hashing password.' );
  87                 }
  88
  89                 // Strip the $2y$
  90                 $parts = explode( $this->getDelimiter(), substr( $hash, 4 ) );
  91                 $this->params['rounds'] = (int)$parts[0];
  92                 $this->args[0] = substr( $parts[1], 0, 22 );
  93                 $this->hash = substr( $parts[1], 22 );
  94         }
  95 }
  96
  97 /** @deprecated since 1.43 use MediaWiki\\Password\\BcryptPassword */
  98 class_alias( BcryptPassword::class, 'BcryptPassword' );