diff options
author | Roeland Jago Douma <roeland@famdouma.nl> | 2018-10-03 00:31:55 +0300 |
---|---|---|
committer | Roeland Jago Douma <roeland@famdouma.nl> | 2018-10-03 01:37:20 +0300 |
commit | 0c9a3de68f746f0f39513a579d69799a2aec5ad0 (patch) | |
tree | 9c8abd4da50a6029d9e5e61bf4479fb018dcdb93 /lib | |
parent | 8ede3f6346aaf96671878b320b82fd5542acef91 (diff) |
Just update password hash without validating
Fixes #11097
If your password hash changed (becuse your are on 7.2 and we moved to
ARGON2). Then we shold not 'set a new password' but just update the
hash. As else we invoke the password policy again which might lock out
users.
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
Diffstat (limited to 'lib')
-rw-r--r-- | lib/private/User/Database.php | 20 |
1 files changed, 12 insertions, 8 deletions
diff --git a/lib/private/User/Database.php b/lib/private/User/Database.php index 532b2f8c03c..905a199a1a6 100644 --- a/lib/private/User/Database.php +++ b/lib/private/User/Database.php @@ -176,6 +176,16 @@ class Database extends ABackend return $result ? true : false; } + private function updatePassword(string $uid, string $passwordHash): bool { + $query = $this->dbConn->getQueryBuilder(); + $query->update($this->table) + ->set('password', $query->createNamedParameter($passwordHash)) + ->where($query->expr()->eq('uid_lower', $query->createNamedParameter(mb_strtolower($uid)))); + $result = $query->execute(); + + return $result ? true : false; + } + /** * Set password * @@ -195,13 +205,7 @@ class Database extends ABackend $hasher = \OC::$server->getHasher(); $hashedPassword = $hasher->hash($password); - $query = $this->dbConn->getQueryBuilder(); - $query->update($this->table) - ->set('password', $query->createNamedParameter($hashedPassword)) - ->where($query->expr()->eq('uid_lower', $query->createNamedParameter(mb_strtolower($uid)))); - $result = $query->execute(); - - return $result ? true : false; + return $this->updatePassword($uid, $hashedPassword); } return false; @@ -314,7 +318,7 @@ class Database extends ABackend $newHash = ''; if (\OC::$server->getHasher()->verify($password, $storedHash, $newHash)) { if (!empty($newHash)) { - $this->setPassword($uid, $password); + $this->updatePassword($uid, $newHash); } return (string)$row['uid']; } |