Cadoles/hydra-sql
22
0
Fork 0
Code Issues 4 Pull Requests 2 Projects Releases Wiki Activity

supression des fonctions liées à l'update du hashage de mot de passe
Some checks failed
Cadoles/hydra-sql/pipeline/pr-develop There was a failure building this commit
Details

Browse Source
This commit is contained in:
Rudy Masson
2022-12-16 16:49:24 +01:00
parent 906d8edf82
commit 422e97d329
9 changed files with 26 additions and 117 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
src/SQLLogin/SQLLoginRequest.php
View File

@ -88,15 +88,4 @@ class SQLLoginRequest
return 'SELECT '.$fields.' FROM '.$this->getTableName().' WHERE '.$this->getLoginColumnName().' = :'.$this->getLoginColumnName().';';
}
public function getRequestUpdatePassword()
{
$fieldsToUpdate = $this->getPasswordColumnName().'= :'.$this->getPasswordColumnName().',';
if (!empty($this->getSaltColumnName())) {
$fieldsToUpdate .= $this->getSaltColumnName().'= :'.$this->getSaltColumnName().',';
}
$fieldsToUpdate = substr($fieldsToUpdate, 0, -1);
return 'UPDATE '.$this->getTableName().' SET '.$fieldsToUpdate.' WHERE '.$this->getLoginColumnName().' = :'.$this->getLoginColumnName().';';
}
}

84
src/Security/Hasher/PasswordEncoder.php
View File

@ -2,7 +2,6 @@
namespace App\Security\Hasher;
use App\SQLLogin\Exception\InvalidSQLLoginAlgoException;
use App\SQLLogin\Exception\InvalidSQLLoginConfigurationException;
use App\SQLLogin\Exception\InvalidSQLPasswordException;
use Symfony\Component\PasswordHasher\Exception\InvalidPasswordException;
@ -18,31 +17,25 @@ class PasswordEncoder implements LegacyPasswordHasherInterface
protected ?string $pepper;
protected array $hashAlgoLegacy;
protected ?string $newHashAlgo;
protected array $securityPattern;
public function __construct(?string $pepper, string $hashAlgoLegacy, ?string $newHashAlgo, string $securityPattern)
public function __construct(?string $pepper, string $hashAlgoLegacy, string $securityPattern)
{
$this->pepper = $pepper;
$this->hashAlgoLegacy = explode(',', $hashAlgoLegacy);
$this->newHashAlgo = $newHashAlgo;
$this->securityPattern = explode(',', $securityPattern);
}
/**
* Utilise l'algo legacy
* Pas utilisé
*/
public function hash(string $plainPassword, string $salt = null): string
{
if ($this->isPasswordTooLong($plainPassword)) {
throw new InvalidPasswordException();
}
$completedPlainPassword = $this->getPasswordToHash($plainPassword, $salt);
if ($this->isObsoleteAlgo($this->newHashAlgo)) {
throw new InvalidSQLLoginAlgoException();
}
return password_hash($completedPlainPassword, $this->getValidALgo($this->newHashAlgo));
return hash($plainPassword.$salt, $this->hashAlgoLegacy[0]);
}
public function verify(string $hashedPassword, string $plainPassword, string $salt = null): bool
@ -51,80 +44,27 @@ class PasswordEncoder implements LegacyPasswordHasherInterface
return false;
}
$isNewest = password_get_info($hashedPassword)['algo'] === $this->newHashAlgo;
$completedPassword = $this->getPasswordToHash($plainPassword, $salt);
if ($isNewest) {
if (password_verify($completedPassword, $hashedPassword)) {
return true;
} else {
throw new InvalidSQLPasswordException();
}
}
// Si le mot de passe a besoin d'un rehash ou qu'il n'y a pas de nouvelle méthode indiquée, on sait qu'il faut utiliser l'une des méthodes legacy pour vérifier le mot de passe
if ($this->needsRehash($hashedPassword) || empty($this->newHashAlgo)) {
foreach ($this->hashAlgoLegacy as $algo) {
if ($this->isObsoleteAlgo($algo)) {
if (hash_equals(hash($algo, $completedPassword), $hashedPassword)) {
return true;
}
} else {
if (password_verify($completedPassword, $hashedPassword)) {
return true;
}
foreach ($this->hashAlgoLegacy as $algo) {
if ($this->isObsoleteAlgo($algo)) {
if (hash_equals(hash($algo, $completedPassword), $hashedPassword)) {
return true;
}
} else {
if (password_verify($completedPassword, $hashedPassword)) {
return true;
}
// On vérifie si la méthode legacy est obsolète, si oui on ne peut pas utiliser password_verify, on doit hasher et comparer
}
// si on on n'a pas encore retourné de résultat, le mot de passe doit être incorrect
throw new InvalidSQLPasswordException();
}
// Si on n'est pas rentré dans les conditions précedéntes, on peut utiliser password_verify
if (password_verify($completedPassword, $hashedPassword)) {
return true;
} else {
throw new InvalidSQLPasswordException();
}
throw new InvalidSQLPasswordException();
}
public function needsRehash(string $hashedPassword): bool
{
// Il y a besoin de tester si on veut mettre à jour le hashage de mot de passe uniquement si le nouveau algo de hashage est indiqué et qu'il est moderne (BCRYPT, ARGON, ...)
if (!empty($this->newHashAlgo) && !$this->isObsoleteAlgo($this->newHashAlgo)) {
return password_needs_rehash($hashedPassword, $this->getValidAlgo($this->newHashAlgo));
}
return false;
}
/**
* @param mixed $algo
*
* @return string
*/
public function getValidAlgo($algo)
{
if ($algo) {
if (in_array($algo, hash_algos())) {
return $algo;
}
$informalAlgos = [
'default' => PASSWORD_DEFAULT,
'bcrypt' => PASSWORD_BCRYPT,
'argon2i' => PASSWORD_ARGON2I,
'argon2id' => PASSWORD_ARGON2ID,
];
if (in_array($algo, array_keys($informalAlgos))) {
return $informalAlgos[$algo];
}
if (in_array($algo, password_algos())) {
return $algo;
}
throw new InvalidSQLLoginAlgoException('Invalid Algorythme');
}
}
public function isObsoleteAlgo($algo): bool
{
return in_array($algo, hash_algos());

8
src/Security/SQLLoginUserAuthenticator.php
View File

@ -82,10 +82,10 @@ class SQLLoginUserAuthenticator extends AbstractAuthenticator
// Comparaison remote hash et hash du input password + salt
// dump($remoteHashedPassword, $plaintextPassword, $remoteSalt, password_verify($plaintextPassword, $remoteHashedPassword));
$this->passwordHasher->verify($remoteHashedPassword, $plaintextPassword, $remoteSalt);
if ($this->passwordHasher->needsRehash($remoteHashedPassword)) {
$hash = $this->passwordHasher->hash($plaintextPassword);
$this->sqlLoginService->updatePassword($login, $hash, null);
}
// if ($this->passwordHasher->needsRehash($remoteHashedPassword)) {
// $hash = $this->passwordHasher->hash($plaintextPassword);
// $this->sqlLoginService->updatePassword($login, $hash, null);
// }
$attributes = $this->sqlLoginService->fetchDatas($login);
$user = new User($login, $remoteHashedPassword, $attributes, $rememberMe);

17
src/Service/SQLLoginService.php
View File

@ -63,23 +63,6 @@ class SQLLoginService extends AbstractController
return false;
}
public function updatePassword($login, $hashedPassword, $salt)
{
try {
$dbh = $this->getConnection();
$request = $this->sqlLoginRequest->getRequestUpdatePassword();
$query = $dbh->prepare($request);
$query->execute([
$this->sqlLoginRequest->getLoginColumnName() => $login,
$this->sqlLoginRequest->getPasswordColumnName() => $hashedPassword,
$this->sqlLoginRequest->getSaltColumnName() => $salt,
]);
} catch (PDOException $e) {
\Sentry\captureException($e);
throw new PDOException();
}
}
public function getConnection()
{
// Appel du singleton