Nemcio/Kleeja
1
0
Fork 0
mirror of https://github.com/kleeja-official/kleeja.git synced 2025-12-16 04:59:42 +01:00
Code Issues Packages Projects Releases Activity

Update phpass.php

Browse Source
This commit is contained in:
Hani Rouatbi
2023-07-01 12:32:53 +01:00
parent ed0badfae3
commit 2baa15bae7
1 changed files with 33 additions and 67 deletions
Download Patch File Download Diff File Expand all files Collapse all files

100
includes/phpass.php
View File

@@ -2,10 +2,10 @@
//
// Portable PHP password hashing framework.
//
// Version 0.1 / genuine.
// Version 0.5.4 / genuine.
//
// Written by Solar Designer <solar at openwall.com> in 2004-2006 and placed in
// the public domain.
// the public domain. Revised in subsequent years, still public domain.
//
// There's absolutely no warranty.
//
@@ -24,7 +24,6 @@
// Obviously, since this code is in the public domain, the above are not
// requirements (there can be none), but merely suggestions.
//
// @version $Id: phpass.php 1551 2010-07-25 22:09:47Z saanina $
//no for directly open
if (! defined('IN_COMMON'))
@@ -51,14 +50,18 @@ class PasswordHash
$this->portable_hashes = $portable_hashes;
$this->random_state = microtime() . getmypid();
$this->random_state = microtime();
if (function_exists('getmypid'))
{
$this->random_state .= getmypid();
}
}
public function get_random_bytes($count)
{
$output = '';
if (($fh = @fopen('/dev/urandom', 'rb')))
if (@is_readable('/dev/urandom') && ($fh = @fopen('/dev/urandom', 'rb')))
{
$output = fread($fh, $count);
fclose($fh);
@@ -71,7 +74,7 @@ class PasswordHash
for ($i = 0; $i < $count; $i += 16)
{
$this->random_state = md5(microtime() . $this->random_state);
$output .= pack('H*', md5($this->random_state));
$output .= md5($this->random_state, true);
}
$output = substr($output, 0, $count);
@@ -119,7 +122,7 @@ class PasswordHash
public function gensalt_private($input)
{
$output = '$P$';
$output .= $this->itoa64[min($this->iteration_count_log2 + ((PHP_VERSION >= '5') ? 5 : 3), 30)];
$output .= $this->itoa64[min($this->iteration_count_log2 + 5, 30)];
$output .= $this->encode64($input, 6);
return $output;
@@ -129,12 +132,14 @@ class PasswordHash
{
$output = '*0';
if (substr($setting, 0, 2) == $output)
if (substr($setting, 0, 2) === $output)
{
$output = '*1';
}
if (substr($setting, 0, 3) != '$P$')
$id = substr($setting, 0, 3);
// We use "$P$", phpBB3 uses "$H$" for the same thing
if ($id !== '$P$' && $id !== '$H$')
{
return $output;
}
@@ -150,33 +155,22 @@ class PasswordHash
$salt = substr($setting, 4, 8);
if (strlen($salt) != 8)
if (strlen($salt) !== 8)
{
return $output;
}
// We're kind of forced to use MD5 here since it's the only
// cryptographic primitive available in all versions of PHP
// currently in use. To implement our own low-level crypto
// in PHP would result in much worse performance and
// We were kind of forced to use MD5 here since it's the only
// cryptographic primitive that was available in all versions
// of PHP in use. To implement our own low-level crypto in PHP
// would have resulted in much worse performance and
// consequently in lower iteration counts and hashes that are
// quicker to crack (by non-PHP code).
if (PHP_VERSION >= '5')
$hash = md5($salt . $password, true);
do
{
$hash = md5($salt . $password, true);
do
{
$hash = md5($hash . $password, true);
} while (--$count);
}
else
{
$hash = pack('H*', md5($salt . $password));
do
{
$hash = pack('H*', md5($hash . $password));
} while (--$count);
}
$hash = md5($hash . $password, true);
} while (--$count);
$output = substr($setting, 0, 12);
$output .= $this->encode64($hash, 16);
@@ -184,24 +178,6 @@ class PasswordHash
return $output;
}
public function gensalt_extended($input)
{
$count_log2 = min($this->iteration_count_log2 + 8, 24);
// This should be odd to not reveal weak DES keys, and the
// maximum valid value is (2**24 - 1) which is odd anyway.
$count = (1 << $count_log2) - 1;
$output = '_';
$output .= $this->itoa64[$count & 0x3f];
$output .= $this->itoa64[($count >> 6) & 0x3f];
$output .= $this->itoa64[($count >> 12) & 0x3f];
$output .= $this->itoa64[($count >> 18) & 0x3f];
$output .= $this->encode64($input, 3);
return $output;
}
public function gensalt_blowfish($input)
{
// This one needs to use a different order of characters and a
@@ -215,7 +191,7 @@ class PasswordHash
$itoa64 = './ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
$output = '$2a$';
$output .= chr(ord('0') + $this->iteration_count_log2 / 10);
$output .= chr((int)(ord('0') + $this->iteration_count_log2 / 10));
$output .= chr(ord('0') + $this->iteration_count_log2 % 10);
$output .= '$';
@@ -251,26 +227,12 @@ class PasswordHash
{
$random = '';
if (CRYPT_BLOWFISH == 1 && ! $this->portable_hashes)
if (CRYPT_BLOWFISH === 1 && ! $this->portable_hashes)
{
$random = $this->get_random_bytes(16);
$hash = crypt($password, $this->gensalt_blowfish($random));
if (strlen($hash) == 60)
{
return $hash;
}
}
if (CRYPT_EXT_DES == 1 && ! $this->portable_hashes)
{
if (strlen($random) < 3)
{
$random = $this->get_random_bytes(3);
}
$hash = crypt($password, $this->gensalt_extended($random));
if (strlen($hash) == 20)
if (strlen($hash) === 60)
{
return $hash;
}
@@ -284,7 +246,7 @@ class PasswordHash
$this->crypt_private($password,
$this->gensalt_private($random));
if (strlen($hash) == 34)
if (strlen($hash) === 34)
{
return $hash;
}
@@ -299,11 +261,15 @@ class PasswordHash
{
$hash = $this->crypt_private($password, $stored_hash);
if ($hash[0] == '*')
if ($hash[0] === '*')
{
$hash = crypt($password, $stored_hash);
}
return $hash == $stored_hash;
// This is not constant-time. In order to keep the code simple,
// for timing safety we currently rely on the salts being
// unpredictable, which they are at least in the non-fallback
// cases (that is, when we use /dev/urandom and bcrypt).
return $hash === $stored_hash;
}
}