silverstripe-framework/tests/php/Security/PasswordEncryptorTest.php

<?php

namespace SilverStripe\Security\Tests;


use SilverStripe\Security\PasswordEncryptor_Blowfish;
use SilverStripe\Security\PasswordEncryptor;
use SilverStripe\Core\Config\Config;
use SilverStripe\Dev\SapphireTest;
use SilverStripe\Security\PasswordEncryptor_LegacyPHPHash;
use SilverStripe\Security\PasswordEncryptor_PHPHash;
use SilverStripe\Security\Tests\PasswordEncryptorTest\TestEncryptor;

class PasswordEncryptorTest extends SapphireTest {

	/**
	 *
	 * @var Config
	 */
	private $config = null;

	public function setUp() {
		parent::setUp();
		$this->config = clone(Config::inst());
	}

	public function tearDown() {
		parent::tearDown();
		Config::set_instance($this->config);
		PasswordEncryptor_Blowfish::set_cost(10);
	}

	public function testCreateForCode() {
		Config::inst()->update(
			PasswordEncryptor::class,
			'encryptors',
			['test' => [TestEncryptor::class => null]]
		);
		$e = PasswordEncryptor::create_for_algorithm('test');
		$this->assertInstanceOf(TestEncryptor::class, $e );
	}

	/**
	 * @expectedException \SilverStripe\Security\PasswordEncryptor_NotFoundException
	 */
	public function testCreateForCodeNotFound() {
		PasswordEncryptor::create_for_algorithm('unknown');
	}

	public function testRegister() {
		Config::inst()->update(
			PasswordEncryptor::class,
			'encryptors',
			array('test' => array(TestEncryptor::class => null))
		);
		$encryptors = PasswordEncryptor::get_encryptors();
		$this->assertContains('test', array_keys($encryptors));
		$encryptor = $encryptors['test'];
		$this->assertContains(TestEncryptor::class, key($encryptor));
	}

	public function testUnregister() {
		Config::inst()->update(
			PasswordEncryptor::class,
			'encryptors',
			array('test' => array(TestEncryptor::class => null))
		);
		Config::inst()->remove(PasswordEncryptor::class, 'encryptors', 'test');
		$this->assertNotContains('test', array_keys(PasswordEncryptor::get_encryptors()));
	}

	public function testEncryptorPHPHashWithArguments() {
		Config::inst()->update(
			PasswordEncryptor::class,
			'encryptors',
			['test_md5' => [PasswordEncryptor_PHPHash::class=>'md5']]
		);
		$e = PasswordEncryptor::create_for_algorithm('test_md5');
		$this->assertEquals('md5', $e->getAlgorithm());
	}

	public function testEncryptorPHPHash() {
		Config::inst()->update(
			PasswordEncryptor::class,
			'encryptors',
			['test_sha1' => [PasswordEncryptor_PHPHash::class => 'sha1']]
		);
		$e = PasswordEncryptor::create_for_algorithm('test_sha1');
		$password = 'mypassword';
		$salt = 'mysalt';
		$this->assertEquals(
			hash('sha1', $password . $salt),
			$e->encrypt($password, $salt)
		);
	}

	public function testEncryptorBlowfish() {
		Config::inst()->update(
			PasswordEncryptor::class,
			'encryptors',
			['test_blowfish' => [PasswordEncryptor_Blowfish::class => '']]
		);
		$e = PasswordEncryptor::create_for_algorithm('test_blowfish');

		$password = 'mypassword';

		$salt = $e->salt($password);
		$modSalt = substr($salt, 0, 3) . str_shuffle(substr($salt, 3, strlen($salt)));

		$this->assertTrue($e->checkAEncryptionLevel() == 'y' || $e->checkAEncryptionLevel() == 'x'
			|| $e->checkAEncryptionLevel() == 'a');
		$this->assertTrue($e->check($e->encrypt($password, $salt), "mypassword", $salt));
		$this->assertFalse($e->check($e->encrypt($password, $salt), "anotherpw", $salt));
		$this->assertFalse($e->check($e->encrypt($password, $salt), "mypassword", $modSalt));

		PasswordEncryptor_Blowfish::set_cost(1);
		$salt = $e->salt($password);
		$modSalt = substr($salt, 0, 3) . str_shuffle(substr($salt, 3, strlen($salt)));

		$this->assertNotEquals(1, PasswordEncryptor_Blowfish::get_cost());
		$this->assertEquals(4, PasswordEncryptor_Blowfish::get_cost());

		$this->assertTrue($e->check($e->encrypt($password, $salt), "mypassword", $salt));
		$this->assertFalse($e->check($e->encrypt($password, $salt), "anotherpw", $salt));
		$this->assertFalse($e->check($e->encrypt($password, $salt), "mypassword", $modSalt));

		PasswordEncryptor_Blowfish::set_cost(11);
		$salt = $e->salt($password);
		$modSalt = substr($salt, 0, 3) . str_shuffle(substr($salt, 3, strlen($salt)));

		$this->assertEquals(11, PasswordEncryptor_Blowfish::get_cost());

		$this->assertTrue($e->check($e->encrypt($password, $salt), "mypassword", $salt));
		$this->assertFalse($e->check($e->encrypt($password, $salt), "anotherpw", $salt));
		$this->assertFalse($e->check($e->encrypt($password, $salt), "mypassword", $modSalt));


		PasswordEncryptor_Blowfish::set_cost(35);

		$this->assertNotEquals(35, PasswordEncryptor_Blowfish::get_cost());
		$this->assertEquals(31, PasswordEncryptor_Blowfish::get_cost());

		//Don't actually test this one. It takes too long. 31 takes too long to process
	}

	public function testEncryptorPHPHashCheck() {
		Config::inst()->update(
			PasswordEncryptor::class,
			'encryptors',
			['test_sha1' => [PasswordEncryptor_PHPHash::class => 'sha1']]
		);
		$e = PasswordEncryptor::create_for_algorithm('test_sha1');
		$this->assertTrue($e->check(sha1('mypassword'), 'mypassword'));
		$this->assertFalse($e->check(sha1('mypassword'), 'mywrongpassword'));
	}

	/**
	 * See http://open.silverstripe.org/ticket/3004
	 *
	 * Handy command for reproducing via CLI on different architectures:
	 * 	php -r "echo(base_convert(sha1('mypassword'), 16, 36));"
	 */
	public function testEncryptorLegacyPHPHashCheck() {
		Config::inst()->update(
			PasswordEncryptor::class,
			'encryptors',
			['test_sha1legacy' => [PasswordEncryptor_LegacyPHPHash::class => 'sha1']]
		);
		$e = PasswordEncryptor::create_for_algorithm('test_sha1legacy');
		// precomputed hashes for 'mypassword' from different architectures
		$amdHash = 'h1fj0a6m4o6k0sosks88oo08ko4gc4s';
		$intelHash = 'h1fj0a6m4o0g04ocg00o4kwoc4wowws';
		$wrongHash = 'h1fjxxxxxxxxxxxxxxxxxxxxxxxxxxx';
		$this->assertTrue($e->check($amdHash, "mypassword"));
		$this->assertTrue($e->check($intelHash, "mypassword"));
		$this->assertFalse($e->check($wrongHash, "mypassword"));
	}
}