includes/password/EncryptedPassword.php

   1 <?php
   2 /**
   3  * Implements the EncryptedPassword class for the MediaWiki software.
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation; either version 2 of the License, or
   8  * (at your option) any later version.
   9  *
  10  * This program is distributed in the hope that it will be useful,
  11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  13  * GNU General Public License for more details.
  14  *
  15  * You should have received a copy of the GNU General Public License along
  16  * with this program; if not, write to the Free Software Foundation, Inc.,
  17  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  18  * http://www.gnu.org/copyleft/gpl.html
  19  *
  20  * @file
  21  */
  22
  23 /**
  24  * Helper class for passwords that use another password hash underneath it
  25  * and encrypts that hash with a configured secret.
  26  *
  27  * @since 1.24
  28  */
  29 class EncryptedPassword extends ParameterizedPassword {
  30         protected function getDelimiter() {
  31                 return ':';
  32         }
  33
  34         protected function getDefaultParams() {
  35                 return [
  36                         'cipher' => $this->config['cipher'],
  37                         'secret' => count( $this->config['secrets'] ) - 1
  38                 ];
  39         }
  40
  41         public function crypt( $password ) {
  42                 $secret = $this->config['secrets'][$this->params['secret']];
  43
  44                 if ( $this->hash ) {
  45                         $underlyingPassword = $this->factory->newFromCiphertext( openssl_decrypt(
  46                                         base64_decode( $this->hash ), $this->params['cipher'],
  47                                         $secret, 0, base64_decode( $this->args[0] )
  48                                 ) );
  49                 } else {
  50                         $underlyingPassword = $this->factory->newFromType( $this->config['underlying'] );
  51                 }
  52
  53                 $underlyingPassword->crypt( $password );
  54                 $iv = MWCryptRand::generate( openssl_cipher_iv_length( $this->params['cipher'] ), true );
  55
  56                 $this->hash = openssl_encrypt(
  57                         $underlyingPassword->toString(), $this->params['cipher'], $secret, 0, $iv );
  58                 $this->args = [ base64_encode( $iv ) ];
  59         }
  60
  61         /**
  62          * Updates the underlying hash by encrypting it with the newest secret.
  63          *
  64          * @throws MWException If the configuration is not valid
  65          * @return bool True if the password was updated
  66          */
  67         public function update() {
  68                 if ( count( $this->args ) != 2 || $this->params == $this->getDefaultParams() ) {
  69                         // Hash does not need updating
  70                         return false;
  71                 }
  72
  73                 // Decrypt the underlying hash
  74                 $underlyingHash = openssl_decrypt(
  75                         base64_decode( $this->args[1] ),
  76                         $this->params['cipher'],
  77                         $this->config['secrets'][$this->params['secret']],
  78                         0,
  79                         base64_decode( $this->args[0] )
  80                 );
  81
  82                 // Reset the params
  83                 $this->params = $this->getDefaultParams();
  84
  85                 // Check the key size with the new params
  86                 $iv = MWCryptRand::generate( openssl_cipher_iv_length( $this->params['cipher'] ), true );
  87                 $this->hash = base64_encode( openssl_encrypt(
  88                                 $underlyingHash,
  89                                 $this->params['cipher'],
  90                                 $this->config['secrets'][$this->params['secret']],
  91                                 0,
  92                                 $iv
  93                         ) );
  94                 $this->args = [ base64_encode( $iv ) ];
  95
  96                 return true;
  97         }
  98 }