Changeset 18889

Timestamp:

Nov 2, 2012, 2:59:07 PM (11 years ago)

Author:

plg

Message:

feature 2727: improve password security with the use of PasswordHash class.
This class performs salt and multiple iterations. Already used in Wordpress,
Drupal, phpBB and many other web applications.

$confpass_convert is replaced by $confpassword_hash + $confpassword_verify

Location:

trunk

Files:

• admin/include/functions_upgrade.php (modified) (1 diff)
• include/config_default.inc.php (modified) (1 diff)
• include/functions_user.inc.php (modified) (3 diffs)
• include/passwordhash.class.php (added)
• install/db/132-database.php (added)
• install/piwigo_structure-mysql.sql (modified) (1 diff)
• password.php (modified) (1 diff)
• profile.php (modified) (2 diffs)

trunk/admin/include/functions_upgrade.php

@@ -248 +248 @@
   $row = pwg_db_fetch_assoc(pwg_query($query));
 
-  if (!isset($conf['pass_convert']))
-  {
-    $conf['pass_convert'] = create_function('$s', 'return md5($s);');
-  }
-
-  if ($row['password'] != $conf['pass_convert']($password))
+  if (!$conf['password_verify']($password, $row['password']))
   {
     array_push($page['errors'], l10n('Invalid password!'));

trunk/include/config_default.inc.php

@@ -507 +507 @@
   );
 
-// pass_convert : function to crypt or hash the clear user password to store
-// it in the database
-$conf['pass_convert'] = create_function('$s', 'return md5($s);');
+// password_hash: function hash the clear user password to store it in the
+// database. The function takes only one parameter: the clear password.
+$conf['password_hash'] = 'pwg_password_hash';
+
+// password_verify: function that checks the password against its hash. The
+// function takes 2 mandatory parameter : clear password, hashed password +
+// an optional parameter user_id. The user_id is used to update the password
+// with the new hash introduced in Piwigo 2.5. See function
+// pwg_password_verify in include/functions_user.inc.php
+$conf['password_verify'] = 'pwg_password_verify';
 
 // guest_id : id of the anonymous user
 $conf['guest_id'] = 2;
+
 // default_user_id : id of user used for default value
 $conf['default_user_id'] = $conf['guest_id'];

trunk/include/functions_user.inc.php

@@ -183 +183 @@
         $conf['user_fields']['id'] => $next_id,
         $conf['user_fields']['username'] => pwg_db_real_escape_string($login),
-        $conf['user_fields']['password'] => $conf['pass_convert']($password),
+        $conf['user_fields']['password'] => $conf['password_hash']($password),
         $conf['user_fields']['email'] => $mail_address
         );
@@ -1096 +1096 @@
 
 /**
+ * hashes a password, with the PasswordHash class from phpass security
+ * library. We use an "pwg_" prefix because function password_hash is
+ * planned for PHP 5.5. Code inspired from Wordpress.
+ *
+ * @param string $password Plain text user password to hash
+ * @return string The hash string of the password
+ */
+function pwg_password_hash($password)
+{
+  global $pwg_hasher;
+
+  if (empty($pwg_hasher))
+  {
+    require_once(PHPWG_ROOT_PATH.'include/passwordhash.class.php');
+    
+    // We use the portable hash feature from phpass because we can't be sure
+    // Piwigo runs on PHP 5.3+ (and won't run on an older version in the
+    // future)
+    $pwg_hasher = new PasswordHash(13, true);
+  }
+  
+  return $pwg_hasher->HashPassword($password);
+}
+
+/**
+ * Verifies a password, with the PasswordHash class from phpass security
+ * library. We use an "pwg_" prefix because function password_verify is
+ * planned for PHP 5.5. Code inspired from Wordpress.
+ *
+ * @param string $password Plain text user password to hash
+ * @param string $hash may be md5 or phpass hashed password
+ * @param integer $account_id only useful to update password hash from md5 to phpass
+ * @return string The hash string of the password
+ */
+function pwg_password_verify($password, $hash, $user_id=null)
+{
+  global $conf, $pwg_hasher;
+
+  // If the hash is still md5...
+  if (strlen($hash) <= 32)
+  {
+    $check = ($hash == md5($password));
+    
+    if ($check and isset($user_id) and !$conf['external_authentification'])
+    {
+      // Rehash using new hash.
+      $hash = pwg_password_hash($password);
+
+      single_update(
+        USERS_TABLE,
+        array('password' => $hash),
+        array('id' => $user_id)
+        );
+    }
+  }
+
+  // If the stored hash is longer than an MD5, presume the
+  // new style phpass portable hash.
+  if (empty($pwg_hasher))
+  {
+    require_once(PHPWG_ROOT_PATH.'include/passwordhash.class.php');
+    
+    // We use the portable hash feature
+    $pwg_hasher = new PasswordHash(13, true);
+  }
+
+  return $pwg_hasher->CheckPassword($password, $hash);
+}
+
+/**
  * Tries to login a user given username and password (must be MySql escaped)
  * return true on success
@@ -1113 +1183 @@
 ;';
   $row = pwg_db_fetch_assoc(pwg_query($query));
-  if ($row['password'] == $conf['pass_convert']($password))
+  if ($conf['password_verify']($password, $row['password'], $row['id']))
   {
     log_user($row['id'], $remember_me);

trunk/install/piwigo_structure-mysql.sql

@@ -442 +442 @@
   `id` smallint(5) NOT NULL auto_increment,
   `username` varchar(100) binary NOT NULL default '',
-  `password` varchar(32) default NULL,
+  `password` varchar(255) default NULL,
   `mail_address` varchar(255) default NULL,
   PRIMARY KEY  (`id`),

trunk/password.php

@@ -222 +222 @@
   single_update(
     USERS_TABLE,
-    array($conf['user_fields']['password'] => $conf['pass_convert']($_POST['use_new_pwd'])),
+    array($conf['user_fields']['password'] => $conf['password_hash']($_POST['use_new_pwd'])),
     array($conf['user_fields']['id'] => $user_id)
     );

trunk/profile.php

@@ -178 +178 @@
       list($current_password) = pwg_db_fetch_row(pwg_query($query));
 
-      if ($conf['pass_convert']($_POST['password']) != $current_password)
+      if (!$conf['password_verify']($_POST['password'], $current_password))
       {
         $errors[] = l10n('Current password is wrong');
@@ -203 +203 @@
       {
         array_push($fields, $conf['user_fields']['password']);
-        // password is encrpyted with function $conf['pass_convert']
-        $data{$conf['user_fields']['password']} = $conf['pass_convert']($_POST['use_new_pwd']);
+        // password is hashed with function $conf['password_hash']
+        $data{$conf['user_fields']['password']} = $conf['password_hash']($_POST['use_new_pwd']);
       }