diff options
author | Marcin Łojewski <marcin.lojewski@mlojewski.me> | 2018-02-28 23:31:42 +0300 |
---|---|---|
committer | Marcin Łojewski <marcin.lojewski@mlojewski.me> | 2018-02-28 23:31:42 +0300 |
commit | 3251067b38c6ccdb87e1731ce6a3c59f3082feab (patch) | |
tree | 063f6549e2a0e20a9ee9b1b906b5e8c36b7acfa3 | |
parent | 7672c66c75848fb0e1139e672b682b9280e8ddec (diff) |
Set to default new logic. Add cleartext password hash implementation.
TODO:
- add new implementation of the rest of currently supported hashes
- create update.php changing hash names in the config
-rw-r--r-- | lib/HashAlgorithm/Cleartext.php | 75 | ||||
-rw-r--r-- | lib/user_sql.php | 85 | ||||
-rw-r--r-- | templates/admin.php | 2 |
3 files changed, 135 insertions, 27 deletions
diff --git a/lib/HashAlgorithm/Cleartext.php b/lib/HashAlgorithm/Cleartext.php new file mode 100644 index 0000000..17526b1 --- /dev/null +++ b/lib/HashAlgorithm/Cleartext.php @@ -0,0 +1,75 @@ +<?php +/** + * Nextcloud - user_sql + * Copyright (C) 2012-2018 Andreas Böhler <dev (at) aboehler (dot) at> + * + * This program is free software: you can redistribute it and/or modify + * it under the terms of the GNU Affero General Public License as + * published by the Free Software Foundation, either version 3 of the + * License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Affero General Public License for more details. + * + * You should have received a copy of the GNU Affero General Public License + * along with this program. If not, see <https://www.gnu.org/licenses/>. + */ + +namespace OCA\user_sql\HashAlgorithm; + +/** + * Cleartext password hash implementation. + * @author Marcin Łojewski <dev@mlojewski.me> + */ +class Cleartext implements HashAlgorithm +{ + /** + * @var Cleartext + */ + private static $instance; + + private function __construct() + { + } + + /** + * @return Cleartext + */ + public static function getInstance() + { + if (self::$instance === null) { + self::$instance = new Cleartext(); + } + return self::$instance; + } + + /** + * @inheritdoc + */ + public function getVisibleName() + { + return "Cleartext"; + } + + /** + * @inheritdoc + */ + public function getPasswordHash($password) + { + return $password; + } + + /** + * @inheritdoc + */ + public function checkPassword($password, $dbHash) + { + return $password === $dbHash; + } + + private function __clone() + { + } +} diff --git a/lib/user_sql.php b/lib/user_sql.php index b696027..cb6f2a5 100644 --- a/lib/user_sql.php +++ b/lib/user_sql.php @@ -30,7 +30,7 @@ namespace OCA\user_sql; use OC\User\Backend; - +use OCA\user_sql\HashAlgorithm\HashAlgorithm; use OCP\IConfig; use OCP\IUser; use OCP\IUserSession; @@ -281,6 +281,15 @@ class OC_USER_SQL extends BackendUtility implements \OCP\IUserBackend, } /** + * @return HashAlgorithm|bool + */ + private function getHashAlgorithmInstance() { + $cryptoType = $this->settings['set_crypt_type']; + require_once('HashAlgorithm/'. $cryptoType . '.php'); + return call_user_func('OCA\\user_sql\\HashAlgorithm\\' . $cryptoType . "::getInstance"); + } + + /** * Set (change) a user password * This can be enabled/disabled in the settings (set_allow_pwchange) * @@ -305,7 +314,20 @@ class OC_USER_SQL extends BackendUtility implements \OCP\IUserBackend, if ($row === false) { return false; } - $old_password = $row[$this->settings['col_password']]; + + $hashAlgorithm = $this->getHashAlgorithmInstance(); + + if ($hashAlgorithm === false) { + return false; + } + + $enc_password = $hashAlgorithm->getPasswordHash($password); + + if ($enc_password === false) { + return false; + } + + /*$old_password = $row[$this->settings['col_password']]; // Added and disabled updating passwords for Drupal 7 WD 2018-01-04 if ($this->settings['set_crypt_type'] === 'drupal') { @@ -356,7 +378,8 @@ class OC_USER_SQL extends BackendUtility implements \OCP\IUserBackend, $enc_password = '{SHA256}' . OC_USER_SQL::hex_to_base64(hash('sha256', $password, false)); } else { $enc_password = $this->pacrypt($password, $old_password); - } + }*/ + $res = $this->helper->runQuery('setPass', array('uid' => $uid, 'enc_password' => $enc_password), true); @@ -396,7 +419,16 @@ class OC_USER_SQL extends BackendUtility implements \OCP\IUserBackend, Util::writeLog('OC_USER_SQL', "Encrypting and checking password", Util::DEBUG); - // Added handling for Drupal 7 passwords WD 2018-01-04 + + $hashAlgorithm = $this->getHashAlgorithmInstance(); + + if ($hashAlgorithm === false) { + return false; + } + + $ret = $hashAlgorithm->checkPassword($password, $db_pass); + + /*// Added handling for Drupal 7 passwords WD 2018-01-04 if ($this->settings['set_crypt_type'] === 'drupal') { if (!function_exists('user_check_password')) { require_once('drupal.php'); @@ -437,7 +469,8 @@ class OC_USER_SQL extends BackendUtility implements \OCP\IUserBackend, // $ret = $this -> pacrypt($password, $db_pass) === $db_pass; $ret = $this->hash_equals($this->pacrypt($password, $db_pass), $db_pass); - } + }*/ + if ($ret) { Util::writeLog('OC_USER_SQL', "Passwords matching, return true", @@ -620,7 +653,7 @@ class OC_USER_SQL extends BackendUtility implements \OCP\IUserBackend, */ public function getBackendName() { - return 'SQL'; + return 'user_sql'; } /** @@ -637,7 +670,7 @@ class OC_USER_SQL extends BackendUtility implements \OCP\IUserBackend, * @param string $pw_db encrypted password from database * @return string encrypted password. */ - private function pacrypt($pw, $pw_db = "") + /*private function pacrypt($pw, $pw_db = "") { Util::writeLog('OC_USER_SQL', "Entering private pacrypt()", Util::DEBUG); @@ -710,7 +743,7 @@ class OC_USER_SQL extends BackendUtility implements \OCP\IUserBackend, Util::writeLog('OC_USER_SQL', "pacrypt() done, return", Util::DEBUG); return $password; - } + }*/ /** * md5crypt @@ -721,7 +754,7 @@ class OC_USER_SQL extends BackendUtility implements \OCP\IUserBackend, * @return string The encrypted password */ - private function md5crypt($pw, $salt = "", $magic = "") + /*private function md5crypt($pw, $salt = "", $magic = "") { $MAGIC = "$1$"; @@ -792,18 +825,18 @@ class OC_USER_SQL extends BackendUtility implements \OCP\IUserBackend, (ord($final[10]) << 8) | (ord($final[5]))), 4); $passwd .= $this->to64(ord($final[11]), 2); return "$magic$salt\$$passwd"; - } + }*/ /** * Create a new salte * @return string The salt */ - private function create_md5salt() + /*private function create_md5salt() { srand((double)microtime() * 1000000); $salt = substr(md5(rand(0, 9999999)), 0, 8); return $salt; - } + }*/ /** * Encrypt using SSHA256 algorithm @@ -811,17 +844,17 @@ class OC_USER_SQL extends BackendUtility implements \OCP\IUserBackend, * @param string $salt The salt to use * @return string The hashed password, prefixed by {SSHA256} */ - private function ssha256($pw, $salt) + /*private function ssha256($pw, $salt) { return '{SSHA256}' . base64_encode(hash('sha256', $pw . $salt, true) . $salt); - } + }*/ /** * PostfixAdmin's hex2bin function * @param string $str The string to convert * @return string The converted string */ - private function pahex2bin($str) + /*private function pahex2bin($str) { if (function_exists('hex2bin')) { return hex2bin($str); @@ -834,12 +867,12 @@ class OC_USER_SQL extends BackendUtility implements \OCP\IUserBackend, } return $nstr; } - } + }*/ /** * Convert to 64? */ - private function to64($v, $n) + /*private function to64($v, $n) { $ITOA64 = "./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"; @@ -850,7 +883,7 @@ class OC_USER_SQL extends BackendUtility implements \OCP\IUserBackend, $v = $v >> 6; } return $ret; - } + }*/ /** * Store a value in memcache or the session, if no memcache is available @@ -894,25 +927,25 @@ class OC_USER_SQL extends BackendUtility implements \OCP\IUserBackend, return $retVal; } - private function create_systemsalt($length = 20) + /*private function create_systemsalt($length = 20) { $fp = fopen('/dev/urandom', 'r'); $randomString = fread($fp, $length); fclose($fp); $salt = base64_encode($randomString); return $salt; - } + }*/ - private function pw_hash($password) + /*private function pw_hash($password) { $options = [ 'cost' => 10, ]; return password_hash($password, PASSWORD_BCRYPT, $options); - } + }*/ - function hash_equals($a, $b) + /*function hash_equals($a, $b) { $a_length = strlen($a); @@ -935,14 +968,14 @@ class OC_USER_SQL extends BackendUtility implements \OCP\IUserBackend, } return $result === 0; - } + }*/ - private static function hex_to_base64($hex) + /*private static function hex_to_base64($hex) { $hex_chr = ''; foreach (str_split($hex, 2) as $hexpair) { $hex_chr .= chr(hexdec($hexpair)); } return base64_encode($hex_chr); - } + }*/ } diff --git a/templates/admin.php b/templates/admin.php index 5ff8a8e..fbc35d8 100644 --- a/templates/admin.php +++ b/templates/admin.php @@ -106,7 +106,7 @@ $cfgClass = 'section'; 'drupal' => 'Drupal 7', 'md5' => 'MD5', 'md5crypt' => 'MD5 Crypt', - 'cleartext' => 'Cleartext', + 'Cleartext' => 'Cleartext', 'mysql_encrypt' => 'mySQL ENCRYPT()', 'system' => 'System (crypt)', 'password_hash' => 'password_hash', |