Merge "Restore gray coloring for autocomments"

[lhc/web/wiklou.git] / includes / password / PasswordPolicyChecks.php

diff --git a/includes/password/PasswordPolicyChecks.php b/includes/password/PasswordPolicyChecks.php
index 502f1e0..3c56535 100644 (file)
--- a/includes/password/PasswordPolicyChecks.php
+++ b/includes/password/PasswordPolicyChecks.php
@@ -21,6 +21,8 @@
  */
 
 use Cdb\Reader as CdbReader;
+use MediaWiki\MediaWikiServices;
+use Wikimedia\PasswordBlacklist;
 
 /**
  * Functions to check passwords against a policy requirement
@@ -81,10 +83,12 @@ class PasswordPolicyChecks {
         * @return Status error if username and password match, and policy is true
         */
        public static function checkPasswordCannotMatchUsername( $policyVal, User $user, $password ) {
-               global $wgContLang;
                $status = Status::newGood();
                $username = $user->getName();
-               if ( $policyVal && $wgContLang->lc( $password ) === $wgContLang->lc( $username ) ) {
+               $contLang = MediaWikiServices::getInstance()->getContentLanguage();
+               if (
+                       $policyVal && hash_equals( $contLang->lc( $username ), $contLang->lc( $password ) )
+               ) {
                        $status->error( 'password-name-match' );
                }
                return $status;
@@ -106,12 +110,15 @@ class PasswordPolicyChecks {
                $status = Status::newGood();
                $username = $user->getName();
                if ( $policyVal ) {
-                       if ( isset( $blockedLogins[$username] ) && $password == $blockedLogins[$username] ) {
+                       if (
+                               isset( $blockedLogins[$username] ) &&
+                               hash_equals( $blockedLogins[$username], $password )
+                       ) {
                                $status->error( 'password-login-forbidden' );
                        }
 
                        // Example from ApiChangeAuthenticationRequest
-                       if ( $password === 'ExamplePassword' ) {
+                       if ( hash_equals( 'ExamplePassword', $password ) ) {
                                $status->error( 'password-login-forbidden' );
                        }
                }
@@ -164,4 +171,25 @@ class PasswordPolicyChecks {
                return $status;
        }
 
+       /**
+        * Ensure the password isn't in the list of passwords blacklisted by the
+        * wikimedia/password-blacklist library
+        *
+        * @param bool $policyVal Whether to apply this policy
+        * @param User $user
+        * @param string $password
+        *
+        * @since 1.33
+        *
+        * @return Status
+        */
+       public static function checkPasswordNotInLargeBlacklist( $policyVal, User $user, $password ) {
+               $status = Status::newGood();
+               if ( $policyVal && PasswordBlacklist\PasswordBlacklist::isBlacklisted( $password ) ) {
+                       $status->error( 'passwordinlargeblacklist' );
+               }
+
+               return $status;
+       }
+
 }