From: Hypolite Petovan Date: Sat, 20 Jan 2018 03:49:06 +0000 (-0500) Subject: Centralize password hashing in Model\User X-Git-Url: https://git.mxchange.org/?a=commitdiff_plain;h=209c43ebbc5300133f3d72158c5cdd6e088a4882;p=friendica.git Centralize password hashing in Model\User --- diff --git a/mod/lostpass.php b/mod/lostpass.php index 5934556a8e..abe67f2de2 100644 --- a/mod/lostpass.php +++ b/mod/lostpass.php @@ -7,6 +7,7 @@ use Friendica\App; use Friendica\Core\System; use Friendica\Database\DBM; +use Friendica\Model\User; require_once 'include/boot.php'; require_once 'include/enotify.php'; @@ -84,10 +85,8 @@ function lostpass_content(App $a) return $o; } - $new_password = autoname(6) . mt_rand(100, 9999); - $new_password_encoded = hash('whirlpool', $new_password); - - $result = dba::update('user', ['password' => $new_password_encoded, 'pwdreset' => ''], ['uid' => $user['uid']]); + $new_password = User::generateNewPassword(); + $result = User::updatePassword($user['uid'], $new_password); if (DBM::is_result($result)) { $tpl = get_markup_template('pwdreset.tpl'); $o .= replace_macros($tpl, diff --git a/mod/settings.php b/mod/settings.php index a5a4d4ad50..5193c4a046 100644 --- a/mod/settings.php +++ b/mod/settings.php @@ -2,14 +2,15 @@ /** * @file mod/settings.php */ + use Friendica\App; use Friendica\Content\Feature; use Friendica\Content\Nav; use Friendica\Core\Addon; -use Friendica\Core\System; -use Friendica\Core\Worker; use Friendica\Core\Config; use Friendica\Core\PConfig; +use Friendica\Core\System; +use Friendica\Core\Worker; use Friendica\Database\DBM; use Friendica\Model\GContact; use Friendica\Model\Group; @@ -391,12 +392,8 @@ function settings_post(App $a) } if (!$err) { - $password = hash('whirlpool', $newpass); - $r = q("UPDATE `user` SET `password` = '%s' WHERE `uid` = %d", - dbesc($password), - intval(local_user()) - ); - if (DBM::is_result($r)) { + $result = User::updatePassword(local_user(), $newpass); + if (DBM::is_result($result)) { info(t('Password changed.') . EOL); } else { notice(t('Password update failed. Please try again.') . EOL); diff --git a/src/Model/User.php b/src/Model/User.php index 862a9d4084..0979c2275d 100644 --- a/src/Model/User.php +++ b/src/Model/User.php @@ -142,7 +142,7 @@ class User return false; } - $password_hashed = hash('whirlpool', $password); + $password_hashed = self::hashPassword($password); if ($password_hashed !== $user['password']) { return false; @@ -151,6 +151,52 @@ class User return $user['uid']; } + /** + * Generates a human-readable random password + * + * @return string + */ + public static function generateNewPassword() + { + return autoname(6) . mt_rand(100, 9999); + } + + /** + * Global user password hashing function + * + * @param string $password + * @return string + */ + private static function hashPassword($password) + { + return hash('whirlpool', $password); + } + + /** + * Updates a user row with a new plaintext password + * + * @param int $uid + * @param string $password + * @return bool + */ + public static function updatePassword($uid, $password) + { + return self::updatePasswordHashed($uid, self::hashPassword($password)); + } + + /** + * Updates a user row with a new hashed password. + * Empties the password reset token field just in case. + * + * @param int $uid + * @param string $pasword_hashed + * @return bool + */ + private static function updatePasswordHashed($uid, $pasword_hashed) + { + return dba::update('user', ['password' => $pasword_hashed, 'pwdreset' => ''], ['uid' => $uid]); + } + /** * @brief Catch-all user creation function * @@ -290,8 +336,8 @@ class User throw new Exception(t('Nickname is already registered. Please choose another.')); } - $new_password = strlen($password) ? $password : autoname(6) . mt_rand(100, 9999); - $new_password_encoded = hash('whirlpool', $new_password); + $new_password = strlen($password) ? $password : User::generateNewPassword(); + $new_password_encoded = self::hashPassword($new_password); $return['password'] = $new_password;