$user = self::getAuthenticationInfo($user_info);
if (strpos($user['password'], '$') === false) {
+ //Legacy hash that has not been replaced by a new hash yet
if (self::hashPasswordLegacy($password) === $user['password']) {
self::updatePassword($user['uid'], $password);
+ return $user['uid'];
+ }
+ } elseif (!empty($user['legacy_password'])) {
+ //Legacy hash that has been double-hashed and not replaced by a new hash yet
+ //Warning: `legacy_password` is not necessary in sync with the content of `password`
+ if (password_verify(self::hashPasswordLegacy($password), $user['password'])) {
+ self::updatePassword($user['uid'], $password);
+
return $user['uid'];
}
} elseif (password_verify($password, $user['password'])) {
+ //New password hash
if (password_needs_rehash($user['password'], PASSWORD_DEFAULT)) {
self::updatePassword($user['uid'], $password);
}
*/
public static function hashPassword($password)
{
+ if (!trim($password)) {
+ throw new Exception(L10n::t('Password can\'t be empty'));
+ }
+
return password_hash($password, PASSWORD_DEFAULT);
}