includes/password/PasswordPolicyChecks.php

   1 <?php
   2 /**
   3  * Password policy checks
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation; either version 2 of the License, or
   8  * (at your option) any later version.
   9  *
  10  * This program is distributed in the hope that it will be useful,
  11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  13  * GNU General Public License for more details.
  14  *
  15  * You should have received a copy of the GNU General Public License along
  16  * with this program; if not, write to the Free Software Foundation, Inc.,
  17  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  18  * http://www.gnu.org/copyleft/gpl.html
  19  *
  20  * @file
  21  */
  22
  23 use Cdb\Reader as CdbReader;
  24 use MediaWiki\MediaWikiServices;
  25 use Wikimedia\PasswordBlacklist;
  26
  27 /**
  28  * Functions to check passwords against a policy requirement.
  29  *
  30  * $policyVal is the value configured in $wgPasswordPolicy. If the return status is fatal,
  31  * the user won't be allowed to login. If the status is not good but not fatal, the user
  32  * will not be allowed to set the given password (on registration or password change),
  33  * but can still log in after bypassing a warning.
  34  *
  35  * @since 1.26
  36  * @see $wgPasswordPolicy
  37  */
  38 class PasswordPolicyChecks {
  39
  40         /**
  41          * Check password is longer than minimum, not fatal.
  42          * @param int $policyVal minimal length
  43          * @param User $user
  44          * @param string $password
  45          * @return Status error if $password is shorter than $policyVal
  46          */
  47         public static function checkMinimalPasswordLength( $policyVal, User $user, $password ) {
  48                 $status = Status::newGood();
  49                 if ( $policyVal > strlen( $password ) ) {
  50                         $status->error( 'passwordtooshort', $policyVal );
  51                 }
  52                 return $status;
  53         }
  54
  55         /**
  56          * Check password is longer than minimum, fatal.
  57          * Intended for locking out users with passwords too short to trust, requiring them
  58          * to recover their account by some other means.
  59          * @param int $policyVal minimal length
  60          * @param User $user
  61          * @param string $password
  62          * @return Status fatal if $password is shorter than $policyVal
  63          */
  64         public static function checkMinimumPasswordLengthToLogin( $policyVal, User $user, $password ) {
  65                 $status = Status::newGood();
  66                 if ( $policyVal > strlen( $password ) ) {
  67                         $status->fatal( 'passwordtooshort', $policyVal );
  68                 }
  69                 return $status;
  70         }
  71
  72         /**
  73          * Check password is shorter than maximum, fatal.
  74          * Intended for preventing DoS attacks when using a more expensive password hash like PBKDF2.
  75          * @param int $policyVal maximum length
  76          * @param User $user
  77          * @param string $password
  78          * @return Status fatal if $password is shorter than $policyVal
  79          */
  80         public static function checkMaximalPasswordLength( $policyVal, User $user, $password ) {
  81                 $status = Status::newGood();
  82                 if ( $policyVal < strlen( $password ) ) {
  83                         $status->fatal( 'passwordtoolong', $policyVal );
  84                 }
  85                 return $status;
  86         }
  87
  88         /**
  89          * Check if username and password are a (case-insensitive) match.
  90          * @param bool $policyVal true to force compliance.
  91          * @param User $user
  92          * @param string $password
  93          * @return Status error if username and password match, and policy is true
  94          */
  95         public static function checkPasswordCannotMatchUsername( $policyVal, User $user, $password ) {
  96                 $status = Status::newGood();
  97                 $username = $user->getName();
  98                 $contLang = MediaWikiServices::getInstance()->getContentLanguage();
  99                 if (
 100                         $policyVal && hash_equals( $contLang->lc( $username ), $contLang->lc( $password ) )
 101                 ) {
 102                         $status->error( 'password-name-match' );
 103                 }
 104                 return $status;
 105         }
 106
 107         /**
 108          * Check if username and password are on a blacklist of past MediaWiki default passwords.
 109          * @param bool $policyVal true to force compliance.
 110          * @param User $user
 111          * @param string $password
 112          * @return Status error if username and password match, and policy is true
 113          */
 114         public static function checkPasswordCannotMatchBlacklist( $policyVal, User $user, $password ) {
 115                 static $blockedLogins = [
 116                         'Useruser' => 'Passpass', 'Useruser1' => 'Passpass1', # r75589
 117                         'Apitestsysop' => 'testpass', 'Apitestuser' => 'testpass' # r75605
 118                 ];
 119
 120                 $status = Status::newGood();
 121                 $username = $user->getName();
 122                 if ( $policyVal ) {
 123                         if (
 124                                 isset( $blockedLogins[$username] ) &&
 125                                 hash_equals( $blockedLogins[$username], $password )
 126                         ) {
 127                                 $status->error( 'password-login-forbidden' );
 128                         }
 129
 130                         // Example from ApiChangeAuthenticationRequest
 131                         if ( hash_equals( 'ExamplePassword', $password ) ) {
 132                                 $status->error( 'password-login-forbidden' );
 133                         }
 134                 }
 135                 return $status;
 136         }
 137
 138         /**
 139          * Ensure that password isn't in top X most popular passwords, as defined by
 140          * $wgPopularPasswordFile.
 141          *
 142          * @param int $policyVal Cut off to use. Will automatically shrink to the max
 143          *   supported for error messages if set to more than max number of passwords on file,
 144          *   so you can use the PHP_INT_MAX constant here safely.
 145          * @param User $user
 146          * @param string $password
 147          * @since 1.27
 148          * @deprecated since 1.33
 149          * @return Status
 150          * @see $wgPopularPasswordFile
 151          */
 152         public static function checkPopularPasswordBlacklist( $policyVal, User $user, $password ) {
 153                 global $wgPopularPasswordFile, $wgSitename;
 154                 $status = Status::newGood();
 155                 if ( $policyVal > 0 ) {
 156                         $langEn = Language::factory( 'en' );
 157                         $passwordKey = $langEn->lc( trim( $password ) );
 158
 159                         // People often use the name of the current site, which won't be
 160                         // in the common password file. Also check '' for people who use
 161                         // just whitespace.
 162                         $sitename = $langEn->lc( trim( $wgSitename ) );
 163                         $hardcodedCommonPasswords = [ '', 'wiki', 'mediawiki', $sitename ];
 164                         if ( in_array( $passwordKey, $hardcodedCommonPasswords ) ) {
 165                                 $status->error( 'passwordtoopopular' );
 166                                 return $status;
 167                         }
 168
 169                         // This could throw an exception, but there's not a good way
 170                         // of failing gracefully, if say the file is missing, so just
 171                         // let the exception fall through.
 172                         // Format of cdb file is mapping password => popularity rank.
 173                         // See maintenance/createCommonPasswordCdb.php
 174                         $db = CdbReader::open( $wgPopularPasswordFile );
 175
 176                         $res = $db->get( $passwordKey );
 177                         if ( $res && (int)$res <= $policyVal ) {
 178                                 // Note: If you want to find the true number of common
 179                                 // passwords stored (for reporting the error), you have to take
 180                                 // the max of the policyVal and $db->get( '_TOTALENTRIES' ).
 181                                 $status->error( 'passwordtoopopular' );
 182                         }
 183                 }
 184                 return $status;
 185         }
 186
 187         /**
 188          * Ensure the password isn't in the list of passwords blacklisted by the
 189          * wikimedia/password-blacklist library, which contains (as of 0.1.4) the
 190          * 100.000 top passwords from SecLists (as a Bloom filter, with an
 191          * 0.000001 false positive ratio).
 192          *
 193          * @param bool $policyVal Whether to apply this policy
 194          * @param User $user
 195          * @param string $password
 196          *
 197          * @since 1.33
 198          *
 199          * @return Status
 200          */
 201         public static function checkPasswordNotInLargeBlacklist( $policyVal, User $user, $password ) {
 202                 $status = Status::newGood();
 203                 if ( $policyVal && PasswordBlacklist\PasswordBlacklist::isBlacklisted( $password ) ) {
 204                         $status->error( 'passwordinlargeblacklist' );
 205                 }
 206
 207                 return $status;
 208         }
 209
 210 }