class.ilBcryptPasswordEncoder.php

Go to the documentation of this file.

<?php declare(strict_types=1);
/* Copyright (c) 1998-2014 ILIAS open source, Extended GPL, see docs/LICENSE */

require_once 'Services/Password/classes/encoders/class.ilBcryptPhpPasswordEncoder.php';

class ilBcryptPasswordEncoder extends ilBcryptPhpPasswordEncoder
{
    const MIN_SALT_SIZE = 16;

    const SALT_STORAGE_FILENAME = 'pwsalt.txt';

    private $client_salt = null;

    private $is_security_flaw_ignored = false;

    private $backward_compatibility = false;

    private $data_directory = '';

    public function __construct(array $config = [])
    {
        if (!empty($config)) {
            foreach ($config as $key => $value) {
                switch (strtolower($key)) {
                    case 'ignore_security_flaw':
                        $this->setIsSecurityFlawIgnored($value);
                        break;

                    case 'data_directory':
                        $this->setDataDirectory($value);
                        break;
                }
            }
        }

        parent::__construct($config);
    }

    protected function init() : void
    {
        $this->readClientSalt();
    }

    protected function isBcryptSupported() : bool
    {
        return PHP_VERSION_ID >= 50307;
    }

    public function getDataDirectory() : string
    {
        return $this->data_directory;
    }

    public function setDataDirectory(string $data_directory) : void
    {
        $this->data_directory = $data_directory;
    }

    public function isBackwardCompatibilityEnabled() : bool
    {
        return (bool) $this->backward_compatibility;
    }

    public function setBackwardCompatibility(bool $backward_compatibility) : void
    {
        $this->backward_compatibility = (bool) $backward_compatibility;
    }

    public function isSecurityFlawIgnored() : bool
    {
        return (bool) $this->is_security_flaw_ignored;
    }

    public function setIsSecurityFlawIgnored(bool $is_security_flaw_ignored) : void
    {
        $this->is_security_flaw_ignored = (bool) $is_security_flaw_ignored;
    }

    public function getClientSalt() : ?string
    {
        return $this->client_salt;
    }

    public function setClientSalt(?string $client_salt)
    {
        $this->client_salt = $client_salt;
    }

    public function encodePassword(string $raw, string $salt) : string
    {
        if (!$this->getClientSalt()) {
            throw new ilPasswordException('Missing client salt.');
        }

        if ($this->isPasswordTooLong($raw)) {
            throw new ilPasswordException('Invalid password.');
        }

        return $this->encode($raw, $salt);
    }

    public function isPasswordValid(string $encoded, string $raw, string $salt) : bool
    {
        if (!$this->getClientSalt()) {
            throw new ilPasswordException('Missing client salt.');
        }

        return !$this->isPasswordTooLong($raw) && $this->check($encoded, $raw, $salt);
    }

    public function getName() : string
    {
        return 'bcrypt';
    }

    public function requiresSalt() : bool
    {
        return true;
    }

    public function requiresReencoding(string $encoded) : bool
    {
        return false;
    }

    protected function encode(string $raw, string $userSecret) : string
    {
        $clientSecret = $this->getClientSalt();
        $hashedPassword = hash_hmac(
            'whirlpool',
            str_pad($raw, strlen($raw) * 4, sha1($userSecret), STR_PAD_BOTH),
            $clientSecret,
            true
        );
        $salt = substr(
            str_shuffle(str_repeat('./0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ', 22)),
            0,
            22
        );

        if ($this->isBcryptSupported() && !$this->isBackwardCompatibilityEnabled()) {
            $prefix = '$2y$';
        } else {
            $prefix = '$2a$';
            // check if the password contains 8-bit character
            if (!$this->isSecurityFlawIgnored() && preg_match('/[\x80-\xFF]/', $raw)) {
                throw new ilPasswordException(
                    'The bcrypt implementation used by PHP can contain a security flaw ' .
                    'using passwords with 8-bit characters. ' .
                    'We suggest to upgrade to PHP 5.3.7+ or use passwords with only 7-bit characters.'
                );
            }
        }

        $saltedPassword = crypt($hashedPassword, $prefix . $this->getCosts() . '$' . $salt);
        if (strlen($saltedPassword) <= 13) {
            throw new ilPasswordException('Error during the bcrypt generation');
        }

        return $saltedPassword;
    }

    protected function check(string $encoded, string $raw, string $salt) : bool
    {
        $hashedPassword = hash_hmac(
            'whirlpool',
            str_pad($raw, strlen($raw) * 4, sha1($salt), STR_PAD_BOTH),
            $this->getClientSalt(),
            true
        );

        return $this->comparePasswords($encoded, crypt($hashedPassword, substr($encoded, 0, 30)));
    }

    public function getClientSaltLocation() : string
    {
        return $this->getDataDirectory() . '/' . self::SALT_STORAGE_FILENAME;
    }

    private function readClientSalt() : void
    {
        if (is_file($this->getClientSaltLocation()) && is_readable($this->getClientSaltLocation())) {
            $contents = file_get_contents($this->getClientSaltLocation());
            if (strlen(trim($contents))) {
                $this->setClientSalt($contents);
            }
        } else {
            $this->generateClientSalt();
            $this->storeClientSalt();
        }
    }

    private function generateClientSalt() : void
    {
        $this->setClientSalt(
            substr(str_replace('+', '.', base64_encode(ilPasswordUtils::getBytes(self::MIN_SALT_SIZE))), 0, 22)
        );
    }

    private function storeClientSalt() : void
    {
        $result = @file_put_contents($this->getClientSaltLocation(), $this->getClientSalt());
        if (!$result) {
            throw new ilPasswordException(sprintf(
                "Could not store the client salt in: %s. Please contact an administrator.",
                $this->getClientSaltLocation()
            ));
        }
    }
}