includes/password/PasswordPolicyChecks.php

   1 <?php
   2 /**
   3  * Password policy checks
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation; either version 2 of the License, or
   8  * (at your option) any later version.
   9  *
  10  * This program is distributed in the hope that it will be useful,
  11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  13  * GNU General Public License for more details.
  14  *
  15  * You should have received a copy of the GNU General Public License along
  16  * with this program; if not, write to the Free Software Foundation, Inc.,
  17  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  18  * http://www.gnu.org/copyleft/gpl.html
  19  *
  20  * @file
  21  */
  22
  23 use Cdb\Reader as CdbReader;
  24 use MediaWiki\MediaWikiServices;
  25 use Wikimedia\PasswordBlacklist;
  26
  27 /**
  28  * Functions to check passwords against a policy requirement
  29  * @since 1.26
  30  */
  31 class PasswordPolicyChecks {
  32
  33         /**
  34          * Check password is longer than minimum, not fatal
  35          * @param int $policyVal minimal length
  36          * @param User $user
  37          * @param string $password
  38          * @return Status error if $password is shorter than $policyVal
  39          */
  40         public static function checkMinimalPasswordLength( $policyVal, User $user, $password ) {
  41                 $status = Status::newGood();
  42                 if ( $policyVal > strlen( $password ) ) {
  43                         $status->error( 'passwordtooshort', $policyVal );
  44                 }
  45                 return $status;
  46         }
  47
  48         /**
  49          * Check password is longer than minimum, fatal
  50          * @param int $policyVal minimal length
  51          * @param User $user
  52          * @param string $password
  53          * @return Status fatal if $password is shorter than $policyVal
  54          */
  55         public static function checkMinimumPasswordLengthToLogin( $policyVal, User $user, $password ) {
  56                 $status = Status::newGood();
  57                 if ( $policyVal > strlen( $password ) ) {
  58                         $status->fatal( 'passwordtooshort', $policyVal );
  59                 }
  60                 return $status;
  61         }
  62
  63         /**
  64          * Check password is shorter than maximum, fatal
  65          * @param int $policyVal maximum length
  66          * @param User $user
  67          * @param string $password
  68          * @return Status fatal if $password is shorter than $policyVal
  69          */
  70         public static function checkMaximalPasswordLength( $policyVal, User $user, $password ) {
  71                 $status = Status::newGood();
  72                 if ( $policyVal < strlen( $password ) ) {
  73                         $status->fatal( 'passwordtoolong', $policyVal );
  74                 }
  75                 return $status;
  76         }
  77
  78         /**
  79          * Check if username and password match
  80          * @param bool $policyVal true to force compliance.
  81          * @param User $user
  82          * @param string $password
  83          * @return Status error if username and password match, and policy is true
  84          */
  85         public static function checkPasswordCannotMatchUsername( $policyVal, User $user, $password ) {
  86                 $status = Status::newGood();
  87                 $username = $user->getName();
  88                 $contLang = MediaWikiServices::getInstance()->getContentLanguage();
  89                 if (
  90                         $policyVal && hash_equals( $contLang->lc( $username ), $contLang->lc( $password ) )
  91                 ) {
  92                         $status->error( 'password-name-match' );
  93                 }
  94                 return $status;
  95         }
  96
  97         /**
  98          * Check if username and password are on a blacklist
  99          * @param bool $policyVal true to force compliance.
 100          * @param User $user
 101          * @param string $password
 102          * @return Status error if username and password match, and policy is true
 103          */
 104         public static function checkPasswordCannotMatchBlacklist( $policyVal, User $user, $password ) {
 105                 static $blockedLogins = [
 106                         'Useruser' => 'Passpass', 'Useruser1' => 'Passpass1', # r75589
 107                         'Apitestsysop' => 'testpass', 'Apitestuser' => 'testpass' # r75605
 108                 ];
 109
 110                 $status = Status::newGood();
 111                 $username = $user->getName();
 112                 if ( $policyVal ) {
 113                         if (
 114                                 isset( $blockedLogins[$username] ) &&
 115                                 hash_equals( $blockedLogins[$username], $password )
 116                         ) {
 117                                 $status->error( 'password-login-forbidden' );
 118                         }
 119
 120                         // Example from ApiChangeAuthenticationRequest
 121                         if ( hash_equals( 'ExamplePassword', $password ) ) {
 122                                 $status->error( 'password-login-forbidden' );
 123                         }
 124                 }
 125                 return $status;
 126         }
 127
 128         /**
 129          * Ensure that password isn't in top X most popular passwords
 130          *
 131          * @param int $policyVal Cut off to use. Will automatically shrink to the max
 132          *   supported for error messages if set to more than max number of passwords on file,
 133          *   so you can use the PHP_INT_MAX constant here safely.
 134          * @param User $user
 135          * @param string $password
 136          * @since 1.27
 137          * @return Status
 138          */
 139         public static function checkPopularPasswordBlacklist( $policyVal, User $user, $password ) {
 140                 global $wgPopularPasswordFile, $wgSitename;
 141                 $status = Status::newGood();
 142                 if ( $policyVal > 0 ) {
 143                         $langEn = Language::factory( 'en' );
 144                         $passwordKey = $langEn->lc( trim( $password ) );
 145
 146                         // People often use the name of the current site, which won't be
 147                         // in the common password file. Also check '' for people who use
 148                         // just whitespace.
 149                         $sitename = $langEn->lc( trim( $wgSitename ) );
 150                         $hardcodedCommonPasswords = [ '', 'wiki', 'mediawiki', $sitename ];
 151                         if ( in_array( $passwordKey, $hardcodedCommonPasswords ) ) {
 152                                 $status->error( 'passwordtoopopular' );
 153                                 return $status;
 154                         }
 155
 156                         // This could throw an exception, but there's not a good way
 157                         // of failing gracefully, if say the file is missing, so just
 158                         // let the exception fall through.
 159                         // Format of cdb file is mapping password => popularity rank.
 160                         // See maintenance/createCommonPasswordCdb.php
 161                         $db = CdbReader::open( $wgPopularPasswordFile );
 162
 163                         $res = $db->get( $passwordKey );
 164                         if ( $res && (int)$res <= $policyVal ) {
 165                                 // Note: If you want to find the true number of common
 166                                 // passwords stored (for reporting the error), you have to take
 167                                 // the max of the policyVal and $db->get( '_TOTALENTRIES' ).
 168                                 $status->error( 'passwordtoopopular' );
 169                         }
 170                 }
 171                 return $status;
 172         }
 173
 174         /**
 175          * Ensure the password isn't in the list of passwords blacklisted by the
 176          * wikimedia/password-blacklist library
 177          *
 178          * @param bool $policyVal Whether to apply this policy
 179          * @param User $user
 180          * @param string $password
 181          *
 182          * @since 1.33
 183          *
 184          * @return Status
 185          */
 186         public static function checkPasswordNotInLargeBlacklist( $policyVal, User $user, $password ) {
 187                 $status = Status::newGood();
 188                 if ( $policyVal && PasswordBlacklist\PasswordBlacklist::isBlacklisted( $password ) ) {
 189                         $status->error( 'passwordinlargeblacklist' );
 190                 }
 191
 192                 return $status;
 193         }
 194
 195 }