silverstripe-framework/Security/PasswordEncryptor.php

102 lines
2.7 KiB
PHP
Raw Normal View History

<?php
2016-06-23 01:37:22 +02:00
namespace SilverStripe\Security;
use SilverStripe\Core\Config\Config;
2016-06-23 01:37:22 +02:00
use ReflectionClass;
/**
* Allows pluggable password encryption.
* By default, this might be PHP's integrated sha1()
* function, but could also be more sophisticated to facilitate
* password migrations from other systems.
* Use {@link register()} to add new implementations.
2014-08-15 08:53:05 +02:00
*
* Used in {@link Security::encrypt_password()}.
*/
abstract class PasswordEncryptor {
2014-08-15 08:53:05 +02:00
/**
* @var array
* @config
*/
private static $encryptors = array();
2014-08-15 08:53:05 +02:00
/**
2016-06-23 01:37:22 +02:00
* @return array Map of encryptor code to the used class.
*/
public static function get_encryptors() {
2016-06-23 01:37:22 +02:00
return Config::inst()->get('SilverStripe\\Security\\PasswordEncryptor', 'encryptors');
}
2014-08-15 08:53:05 +02:00
/**
* @param String $algorithm
* @return PasswordEncryptor
* @throws PasswordEncryptor_NotFoundException
*/
public static function create_for_algorithm($algorithm) {
$encryptors = self::get_encryptors();
if(!isset($encryptors[$algorithm])) {
throw new PasswordEncryptor_NotFoundException(
sprintf('No implementation found for "%s"', $algorithm)
);
}
2014-08-15 08:53:05 +02:00
$class=key($encryptors[$algorithm]);
if(!class_exists($class)) {
throw new PasswordEncryptor_NotFoundException(
sprintf('No class found for "%s"', $class)
);
}
$refClass = new ReflectionClass($class);
if(!$refClass->getConstructor()) {
return new $class;
}
2014-08-15 08:53:05 +02:00
$arguments = $encryptors[$algorithm];
return($refClass->newInstanceArgs($arguments));
}
2014-08-15 08:53:05 +02:00
/**
* Return a string value stored in the {@link Member->Password} property.
* The password should be hashed with {@link salt()} if applicable.
2014-08-15 08:53:05 +02:00
*
* @param String $password Cleartext password to be hashed
* @param String $salt (Optional)
* @param Member $member (Optional)
* @return String Maximum of 512 characters.
*/
abstract public function encrypt($password, $salt = null, $member = null);
2014-08-15 08:53:05 +02:00
/**
* Return a string value stored in the {@link Member->Salt} property.
2014-08-15 08:53:05 +02:00
*
* @uses RandomGenerator
2014-08-15 08:53:05 +02:00
*
2016-06-23 01:37:22 +02:00
* @param string $password Cleartext password
* @param Member $member (Optional)
2016-06-23 01:37:22 +02:00
* @return string Maximum of 50 characters
*/
public function salt($password, $member = null) {
$generator = new RandomGenerator();
return substr($generator->randomToken('sha1'), 0, 50);
}
2014-08-15 08:53:05 +02:00
/**
* This usually just returns a strict string comparison,
* but is necessary for retain compatibility with password hashed
* with flawed algorithms - see {@link PasswordEncryptor_LegacyPHPHash} and
* {@link PasswordEncryptor_Blowfish}
2016-06-23 01:37:22 +02:00
*
* @param string $hash
* @param string $password
* @param string $salt
* @param Member $member
* @return bool
*/
public function check($hash, $password, $salt = null, $member = null) {
return $hash === $this->encrypt($password, $salt, $member);
}
}