]>
Commit | Line | Data |
---|---|---|
d9169157 J |
1 | <?php |
2 | ||
3 | namespace Wallabag\CoreBundle\Security\Authentication\Encoder; | |
4 | ||
5 | use Symfony\Component\Security\Core\Encoder\BasePasswordEncoder; | |
6 | use Symfony\Component\Security\Core\Exception\BadCredentialsException; | |
7 | ||
8 | /** | |
9 | * This override just add en extra variable (username) to be able to salt the password | |
10 | * the way Wallabag v1 does. It will avoid to break compatibility with Wallabag v1 | |
11 | * | |
12 | */ | |
13 | class WallabagPasswordEncoder extends BasePasswordEncoder | |
14 | { | |
15 | private $algorithm; | |
16 | private $encodeHashAsBase64; | |
17 | private $iterations; | |
18 | private $username = null; | |
19 | ||
20 | /** | |
21 | * Constructor. | |
22 | * | |
23 | * @param string $algorithm The digest algorithm to use | |
24 | * @param bool $encodeHashAsBase64 Whether to base64 encode the password hash | |
25 | * @param int $iterations The number of iterations to use to stretch the password hash | |
26 | */ | |
27 | public function __construct($algorithm = 'sha512', $encodeHashAsBase64 = true, $iterations = 5000) | |
28 | { | |
29 | $this->algorithm = $algorithm; | |
30 | $this->encodeHashAsBase64 = $encodeHashAsBase64; | |
31 | $this->iterations = $iterations; | |
32 | } | |
33 | ||
34 | public function setUsername($username) | |
35 | { | |
36 | $this->username = $username; | |
37 | } | |
38 | ||
39 | /** | |
40 | * {@inheritdoc} | |
41 | */ | |
42 | public function encodePassword($raw, $salt) | |
43 | { | |
d9169157 J |
44 | if ($this->isPasswordTooLong($raw)) { |
45 | throw new BadCredentialsException('Invalid password.'); | |
46 | } | |
47 | ||
48 | if (!in_array($this->algorithm, hash_algos(), true)) { | |
49 | throw new \LogicException(sprintf('The algorithm "%s" is not supported.', $this->algorithm)); | |
50 | } | |
51 | ||
52 | $salted = $this->mergePasswordAndSalt($raw, $salt); | |
53 | $digest = hash($this->algorithm, $salted, true); | |
54 | ||
55 | // "stretch" hash | |
56 | for ($i = 1; $i < $this->iterations; $i++) { | |
57 | $digest = hash($this->algorithm, $digest.$salted, true); | |
58 | } | |
59 | ||
60 | return $this->encodeHashAsBase64 ? base64_encode($digest) : bin2hex($digest); | |
61 | } | |
62 | ||
63 | /** | |
64 | * {@inheritdoc} | |
65 | * | |
66 | * We inject the username inside the salted password | |
67 | */ | |
68 | protected function mergePasswordAndSalt($password, $salt) | |
69 | { | |
d9085c63 J |
70 | if (null === $this->username) { |
71 | throw new \LogicException('We can not check the password without a username.'); | |
72 | } | |
73 | ||
d9169157 J |
74 | if (empty($salt)) { |
75 | return $password; | |
76 | } | |
77 | ||
78 | return $password.$this->username.$salt; | |
79 | } | |
80 | ||
81 | /** | |
82 | * {@inheritdoc} | |
83 | */ | |
84 | public function isPasswordValid($encoded, $raw, $salt) | |
85 | { | |
86 | return !$this->isPasswordTooLong($raw) && $this->comparePasswords($encoded, $this->encodePassword($raw, $salt)); | |
87 | } | |
88 | } |