includes/password/PasswordPolicyChecks.php

   1 <?php
   2 /**
   3  * Password policy checks
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation; either version 2 of the License, or
   8  * (at your option) any later version.
   9  *
  10  * This program is distributed in the hope that it will be useful,
  11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  13  * GNU General Public License for more details.
  14  *
  15  * You should have received a copy of the GNU General Public License along
  16  * with this program; if not, write to the Free Software Foundation, Inc.,
  17  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  18  * http://www.gnu.org/copyleft/gpl.html
  19  *
  20  * @file
  21  */
  22
  23 namespace MediaWiki\Password;
  24
  25 use MediaWiki\Status\Status;
  26 use MediaWiki\User\UserIdentity;
  27 use Wikimedia\CommonPasswords\CommonPasswords;
  28
  29 /**
  30  * Functions to check passwords against a policy requirement.
  31  *
  32  * $policyVal is the value configured in $wgPasswordPolicy. If the return status is fatal,
  33  * the user won't be allowed to log in. If the status is not good but not fatal, the user
  34  * will not be allowed to set the given password (on registration or password change),
  35  * but can still log in after bypassing a warning.
  36  *
  37  * @since 1.26
  38  * @see $wgPasswordPolicy
  39  */
  40 class PasswordPolicyChecks {
  41
  42         /**
  43          * Check password is longer than the minimum, not fatal.
  44          * @param int $policyVal minimal length
  45          * @param UserIdentity $user
  46          * @param string $password
  47          * @return Status error if $password is shorter than $policyVal
  48          */
  49         public static function checkMinimalPasswordLength( $policyVal, UserIdentity $user, $password ) {
  50                 $status = Status::newGood();
  51                 if ( $policyVal > strlen( $password ) ) {
  52                         $status->error( 'passwordtooshort', $policyVal );
  53                 }
  54                 return $status;
  55         }
  56
  57         /**
  58          * Check password is longer than the minimum, fatal.
  59          * Intended for locking out users with passwords too short to trust, requiring them
  60          * to recover their account by some other means.
  61          * @param int $policyVal minimal length
  62          * @param UserIdentity $user
  63          * @param string $password
  64          * @return Status fatal if $password is shorter than $policyVal
  65          */
  66         public static function checkMinimumPasswordLengthToLogin( $policyVal, UserIdentity $user, $password ) {
  67                 $status = Status::newGood();
  68                 if ( $policyVal > strlen( $password ) ) {
  69                         $status->fatal( 'passwordtooshort', $policyVal );
  70                 }
  71                 return $status;
  72         }
  73
  74         /**
  75          * Check password is shorter than the maximum, fatal.
  76          * Intended for preventing DoS attacks when using a more expensive password hash like PBKDF2.
  77          * @param int $policyVal maximum length
  78          * @param UserIdentity $user
  79          * @param string $password
  80          * @return Status fatal if $password is shorter than $policyVal
  81          */
  82         public static function checkMaximalPasswordLength( $policyVal, UserIdentity $user, $password ) {
  83                 $status = Status::newGood();
  84                 if ( $policyVal < strlen( $password ) ) {
  85                         $status->fatal( 'passwordtoolong', $policyVal );
  86                 }
  87                 return $status;
  88         }
  89
  90         /**
  91          * Check if a password is a (case-insensitive) substring within the username.
  92          * @param bool $policyVal true to force compliance.
  93          * @param UserIdentity $user
  94          * @param string $password
  95          * @return Status error if the password is a substring within username, and the policy is true
  96          */
  97         public static function checkPasswordCannotBeSubstringInUsername(
  98                 $policyVal,
  99                 UserIdentity $user,
 100                 $password
 101         ) {
 102                 $status = Status::newGood();
 103                 $username = $user->getName();
 104                 if ( $policyVal && stripos( $username, $password ) !== false ) {
 105                         $status->error( 'password-substring-username-match' );
 106                 }
 107                 return $status;
 108         }
 109
 110         /**
 111          * Check if username and password are on a list of past MediaWiki default passwords.
 112          * @param bool $policyVal true to force compliance.
 113          * @param UserIdentity $user
 114          * @param string $password
 115          * @return Status error if the username and password match, and policy is true
 116          */
 117         public static function checkPasswordCannotMatchDefaults( $policyVal, UserIdentity $user, $password ) {
 118                 static $blockedLogins = [
 119                         // r75589
 120                         'Useruser' => 'Passpass',
 121                         'Useruser1' => 'Passpass1',
 122                         // r75605
 123                         'Apitestsysop' => 'testpass',
 124                         'Apitestuser' => 'testpass',
 125                 ];
 126
 127                 $status = Status::newGood();
 128                 $username = $user->getName();
 129                 if ( $policyVal ) {
 130                         if (
 131                                 isset( $blockedLogins[$username] ) &&
 132                                 hash_equals( $blockedLogins[$username], $password )
 133                         ) {
 134                                 $status->error( 'password-login-forbidden' );
 135                         }
 136
 137                         // Example from ApiChangeAuthenticationRequest
 138                         if ( hash_equals( 'ExamplePassword', $password ) ) {
 139                                 $status->error( 'password-login-forbidden' );
 140                         }
 141                 }
 142                 return $status;
 143         }
 144
 145         /**
 146          * Ensure the password isn't in the list of common passwords by the
 147          * wikimedia/common-passwords library, which contains (as of 0.2.0) the
 148          * 100,000 top passwords from SecLists (as a Bloom filter, with an
 149          * 0.000001 false positive ratio).
 150          *
 151          * @param bool $policyVal Whether to apply this policy
 152          * @param UserIdentity $user
 153          * @param string $password
 154          *
 155          * @since 1.33
 156          *
 157          * @return Status
 158          */
 159         public static function checkPasswordNotInCommonList( $policyVal, UserIdentity $user, $password ) {
 160                 $status = Status::newGood();
 161                 if ( $policyVal && CommonPasswords::isCommon( $password ) ) {
 162                         $status->error( 'passwordincommonlist' );
 163                 }
 164
 165                 return $status;
 166         }
 167
 168 }