class.ilBasePasswordEncoder.php

Go to the documentation of this file.

<?php
/* Copyright (c) 1998-2014 ILIAS open source, Extended GPL, see docs/LICENSE */
 
require_once 'Services/Password/interfaces/interface.ilPasswordEncoder.php';
 
abstract class ilBasePasswordEncoder implements ilPasswordEncoder
{
        const MAX_PASSWORD_LENGTH = 4096;
 
        protected function comparePasswords($known_string, $user_string)
        {
                // Prevent issues if string length is 0
                $known_string .= chr(0);
                $user_string  .= chr(0);
 
                $known_string_length = strlen($known_string);
                $user_string_length  = strlen($user_string);
 
                // Set the result to the difference between the lengths
                $result = $known_string_length - $user_string_length;
 
                // Note that we ALWAYS iterate over the user-supplied length
                // This is to prevent leaking length information
                for($i = 0; $i < $user_string_length; $i++)
                {
                        // Using % here is a trick to prevent notices
                        // It's safe, since if the lengths are different
                        // $result is already non-0
                        $result |= (ord($known_string[$i % $known_string_length]) ^ ord($user_string[$i]));
                }
 
                // They are only identical strings if $result is exactly 0...
                return 0 === $result;
        }
 
        protected function isPasswordTooLong($password)
        {
                return strlen($password) > self::MAX_PASSWORD_LENGTH;
        }
}