Cadoles/hydra-sql
22
0
Fork 0
Code Issues 4 Pull Requests 2 Projects Releases Wiki Activity

supression des fonctions liées à l'update du hashage de mot de passe
Some checks failed
Cadoles/hydra-sql/pipeline/pr-develop There was a failure building this commit
Details

Browse Source
This commit is contained in:
Rudy Masson
2022-12-16 16:49:24 +01:00
parent 906d8edf82
commit 422e97d329
9 changed files with 26 additions and 117 deletions
Download Patch File Download Diff File Expand all files Collapse all files

84
src/Security/Hasher/PasswordEncoder.php
View File

@ -2,7 +2,6 @@
namespace App\Security\Hasher;
use App\SQLLogin\Exception\InvalidSQLLoginAlgoException;
use App\SQLLogin\Exception\InvalidSQLLoginConfigurationException;
use App\SQLLogin\Exception\InvalidSQLPasswordException;
use Symfony\Component\PasswordHasher\Exception\InvalidPasswordException;
@ -18,31 +17,25 @@ class PasswordEncoder implements LegacyPasswordHasherInterface
protected ?string $pepper;
protected array $hashAlgoLegacy;
protected ?string $newHashAlgo;
protected array $securityPattern;
public function __construct(?string $pepper, string $hashAlgoLegacy, ?string $newHashAlgo, string $securityPattern)
public function __construct(?string $pepper, string $hashAlgoLegacy, string $securityPattern)
{
$this->pepper = $pepper;
$this->hashAlgoLegacy = explode(',', $hashAlgoLegacy);
$this->newHashAlgo = $newHashAlgo;
$this->securityPattern = explode(',', $securityPattern);
}
/**
* Utilise l'algo legacy
* Pas utilisé
*/
public function hash(string $plainPassword, string $salt = null): string
{
if ($this->isPasswordTooLong($plainPassword)) {
throw new InvalidPasswordException();
}
$completedPlainPassword = $this->getPasswordToHash($plainPassword, $salt);
if ($this->isObsoleteAlgo($this->newHashAlgo)) {
throw new InvalidSQLLoginAlgoException();
}
return password_hash($completedPlainPassword, $this->getValidALgo($this->newHashAlgo));
return hash($plainPassword.$salt, $this->hashAlgoLegacy[0]);
}
public function verify(string $hashedPassword, string $plainPassword, string $salt = null): bool
@ -51,80 +44,27 @@ class PasswordEncoder implements LegacyPasswordHasherInterface
return false;
}
$isNewest = password_get_info($hashedPassword)['algo'] === $this->newHashAlgo;
$completedPassword = $this->getPasswordToHash($plainPassword, $salt);
if ($isNewest) {
if (password_verify($completedPassword, $hashedPassword)) {
return true;
} else {
throw new InvalidSQLPasswordException();
}
}
// Si le mot de passe a besoin d'un rehash ou qu'il n'y a pas de nouvelle méthode indiquée, on sait qu'il faut utiliser l'une des méthodes legacy pour vérifier le mot de passe
if ($this->needsRehash($hashedPassword) || empty($this->newHashAlgo)) {
foreach ($this->hashAlgoLegacy as $algo) {
if ($this->isObsoleteAlgo($algo)) {
if (hash_equals(hash($algo, $completedPassword), $hashedPassword)) {
return true;
}
} else {
if (password_verify($completedPassword, $hashedPassword)) {
return true;
}
foreach ($this->hashAlgoLegacy as $algo) {
if ($this->isObsoleteAlgo($algo)) {
if (hash_equals(hash($algo, $completedPassword), $hashedPassword)) {
return true;
}
} else {
if (password_verify($completedPassword, $hashedPassword)) {
return true;
}
// On vérifie si la méthode legacy est obsolète, si oui on ne peut pas utiliser password_verify, on doit hasher et comparer
}
// si on on n'a pas encore retourné de résultat, le mot de passe doit être incorrect
throw new InvalidSQLPasswordException();
}
// Si on n'est pas rentré dans les conditions précedéntes, on peut utiliser password_verify
if (password_verify($completedPassword, $hashedPassword)) {
return true;
} else {
throw new InvalidSQLPasswordException();
}
throw new InvalidSQLPasswordException();
}
public function needsRehash(string $hashedPassword): bool
{
// Il y a besoin de tester si on veut mettre à jour le hashage de mot de passe uniquement si le nouveau algo de hashage est indiqué et qu'il est moderne (BCRYPT, ARGON, ...)
if (!empty($this->newHashAlgo) && !$this->isObsoleteAlgo($this->newHashAlgo)) {
return password_needs_rehash($hashedPassword, $this->getValidAlgo($this->newHashAlgo));
}
return false;
}
/**
* @param mixed $algo
*
* @return string
*/
public function getValidAlgo($algo)
{
if ($algo) {
if (in_array($algo, hash_algos())) {
return $algo;
}
$informalAlgos = [
'default' => PASSWORD_DEFAULT,
'bcrypt' => PASSWORD_BCRYPT,
'argon2i' => PASSWORD_ARGON2I,
'argon2id' => PASSWORD_ARGON2ID,
];
if (in_array($algo, array_keys($informalAlgos))) {
return $informalAlgos[$algo];
}
if (in_array($algo, password_algos())) {
return $algo;
}
throw new InvalidSQLLoginAlgoException('Invalid Algorythme');
}
}
public function isObsoleteAlgo($algo): bool
{
return in_array($algo, hash_algos());