Skip to content

Commit 6e0487b

Browse files
nicolas-grekasnicolas-grekas
committed
[Security] add password rehashing capabilities
1 parent c315767 commit 6e0487b

20 files changed

+260
-13
lines changed

‎src/Symfony/Bridge/Doctrine/Security/User/EntityUserProvider.php

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
use Doctrine\Common\Persistence\ManagerRegistry;
1515
use Symfony\Component\Security\Core\Exception\UnsupportedUserException;
1616
use Symfony\Component\Security\Core\Exception\UsernameNotFoundException;
17+
use Symfony\Component\Security\Core\User\PasswordUpgraderInterface;
1718
use Symfony\Component\Security\Core\User\UserInterface;
1819
use Symfony\Component\Security\Core\User\UserProviderInterface;
1920

@@ -25,7 +26,7 @@
2526
* @author Fabien Potencier <fabien@symfony.com>
2627
* @author Johannes M. Schmitt <schmittjoh@gmail.com>
2728
*/
28-
class EntityUserProvider implements UserProviderInterface
29+
class EntityUserProvider implements UserProviderInterface, PasswordUpgraderInterface
2930
{
3031
private $registry;
3132
private $managerName;
@@ -107,6 +108,22 @@ public function supportsClass($class)
107108
return $class === $this->getClass() || is_subclass_of($class, $this->getClass());
108109
}
109110

111+
/**
112+
* {@inheritdoc}
113+
*/
114+
public function upgradePassword(UserInterface $user, string $newEncodedPassword): void
115+
{
116+
$class = $this->getClass();
117+
if (!$user instanceof $class) {
118+
throw new UnsupportedUserException(sprintf('Instances of "%s" are not supported.', \get_class($user)));
119+
}
120+
121+
$repository = $this->getRepository();
122+
if ($repository instanceof PasswordUpgraderInterface) {
123+
$repository->upgradePassword($user, $newEncodedPassword);
124+
}
125+
}
126+
110127
private function getObjectManager()
111128
{
112129
return $this->registry->getManager($this->managerName);

‎src/Symfony/Bridge/Doctrine/composer.json

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@
3232
"symfony/property-access": "~3.4|~4.0",
3333
"symfony/property-info": "~3.4|~4.0",
3434
"symfony/proxy-manager-bridge": "~3.4|~4.0",
35-
"symfony/security": "~3.4|~4.0",
35+
"symfony/security": "^4.4",
3636
"symfony/expression-language": "~3.4|~4.0",
3737
"symfony/validator": "~3.4|~4.0",
3838
"symfony/translation": "~3.4|~4.0",
@@ -48,7 +48,8 @@
4848
"phpunit/phpunit": "<4.8.35|<5.4.3,>=5.0",
4949
"symfony/dependency-injection": "<3.4",
5050
"symfony/form": "<4.3",
51-
"symfony/messenger": "<4.2"
51+
"symfony/messenger": "<4.2",
52+
"symfony/security-core": "<4.4"
5253
},
5354
"suggest": {
5455
"symfony/form": "",

‎src/Symfony/Component/Security/CHANGELOG.md

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,13 @@
11
CHANGELOG
22
=========
33

4+
4.4.0
5+
-----
6+
7+
* Added `MigratingPasswordEncoder`
8+
* Added methods `PasswordEncoderInterface::needsRehash()` and `UserPasswordEncoderInterface::needsRehash()`
9+
* Added and implemented `PasswordUpgraderInterface`
10+
411
4.3.0
512
-----
613

‎src/Symfony/Component/Security/Core/Authentication/Provider/DaoAuthenticationProvider.php

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
use Symfony\Component\Security\Core\Exception\AuthenticationServiceException;
1717
use Symfony\Component\Security\Core\Exception\BadCredentialsException;
1818
use Symfony\Component\Security\Core\Exception\UsernameNotFoundException;
19+
use Symfony\Component\Security\Core\User\PasswordUpgraderInterface;
1920
use Symfony\Component\Security\Core\User\UserCheckerInterface;
2021
use Symfony\Component\Security\Core\User\UserInterface;
2122
use Symfony\Component\Security\Core\User\UserProviderInterface;
@@ -54,9 +55,15 @@ protected function checkAuthentication(UserInterface $user, UsernamePasswordToke
5455
throw new BadCredentialsException('The presented password cannot be empty.');
5556
}
5657

57-
if (!$this->encoderFactory->getEncoder($user)->isPasswordValid($user->getPassword(), $presentedPassword, $user->getSalt())) {
58+
$encoder = $this->encoderFactory->getEncoder($user);
59+
60+
if (!$encoder->isPasswordValid($user->getPassword(), $presentedPassword, $user->getSalt())) {
5861
throw new BadCredentialsException('The presented password is invalid.');
5962
}
63+
64+
if ($this->userProvider instanceof PasswordUpgraderInterface && method_exists($encoder, 'needsRehash') && $encoder->needsRehash($user->getPassword())) {
65+
$this->userProvider->upgradePassword($user, $encoder->encodePassword($presentedPassword, $user->getSalt()));
66+
}
6067
}
6168
}
6269

‎src/Symfony/Component/Security/Core/Encoder/BasePasswordEncoder.php

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,14 @@ abstract class BasePasswordEncoder implements PasswordEncoderInterface
2020
{
2121
const MAX_PASSWORD_LENGTH = 4096;
2222

23+
/**
24+
* {@inheritdoc}
25+
*/
26+
public function needsRehash(string $encoded): bool
27+
{
28+
return false;
29+
}
30+
2331
/**
2432
* Demerges a merge password and salt string.
2533
*

‎src/Symfony/Component/Security/Core/Encoder/EncoderFactory.php

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,19 @@ private function createEncoder(array $config)
8585
private function getEncoderConfigFromAlgorithm($config)
8686
{
8787
if ('auto' === $config['algorithm']) {
88-
$config['algorithm'] = SodiumPasswordEncoder::isSupported() ? 'sodium' : 'native';
88+
$encoderChain = [];
89+
// "plaintext" is not listed as any leaked hashes could then be used to authenticate directly
90+
foreach (['sodium', 'native', 'pbkdf2', $config['hash_algorithm']] as $algo) {
91+
if ('sodium' !== $algo || SodiumPasswordEncoder::isSupported()) {
92+
$config['algorithm'] = $algo;
93+
$encoderChain[] = $this->createEncoder($config);
94+
}
95+
}
96+
97+
return [
98+
'class' => MigratingPasswordEncoder::class,
99+
'arguments' => $encoderChain,
100+
];
89101
}
90102

91103
switch ($config['algorithm']) {

‎src/Symfony/Component/Security/Core/Encoder/MessageDigestPasswordEncoder.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,6 @@ public function encodePassword($raw, $salt)
6565
*/
6666
public function isPasswordValid($encoded, $raw, $salt)
6767
{
68-
return !$this->isPasswordTooLong($raw) && $this->comparePasswords($encoded, $this->encodePassword($raw, $salt));
68+
return '$' !== substr($encoded, 0, 1) && !$this->isPasswordTooLong($raw) && $this->comparePasswords($encoded, $this->encodePassword($raw, $salt));
6969
}
7070
}

‎src/Symfony/Component/Security/Core/Encoder/MigratingPasswordEncoder.php

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
<?php
2+
3+
/*
4+
* This file is part of the Symfony package.
5+
*
6+
* (c) Fabien Potencier <fabien@symfony.com>
7+
*
8+
* For the full copyright and license information, please view the LICENSE
9+
* file that was distributed with this source code.
10+
*/
11+
12+
namespace Symfony\Component\Security\Core\Encoder;
13+
14+
/**
15+
* Hashes passwords using the best available encoder.
16+
* Validates them using a chain of encoders.
17+
*
18+
* /!\ Don't put a PlaintextPasswordEncoder in the list as that'd mean a leaked hash
19+
* could be used to authenticate successfully without knowing the cleartext password.
20+
*
21+
* @author Nicolas Grekas <p@tchwork.com>
22+
*/
23+
final class MigratingPasswordEncoder extends BasePasswordEncoder implements SelfSaltingEncoderInterface
24+
{
25+
private $bestEncoder;
26+
private $extraEncoders;
27+
28+
public function __construct(PasswordEncoderInterface $bestEncoder, PasswordEncoderInterface ...$extraEncoders)
29+
{
30+
$this->bestEncoder = $bestEncoder;
31+
$this->extraEncoders = $extraEncoders;
32+
}
33+
34+
/**
35+
* {@inheritdoc}
36+
*/
37+
public function encodePassword($raw, $salt)
38+
{
39+
return $this->bestEncoder->encodePassword($raw, $salt);
40+
}
41+
42+
/**
43+
* {@inheritdoc}
44+
*/
45+
public function isPasswordValid($encoded, $raw, $salt)
46+
{
47+
if ($this->bestEncoder->isPasswordValid($encoded, $raw, $salt)) {
48+
return true;
49+
}
50+
51+
if (!$this->bestEncoder->needsRehash($encoded)) {
52+
return false;
53+
}
54+
55+
foreach ($this->extraEncoders as $encoder) {
56+
if ($encoder->isPasswordValid($encoded, $raw, $salt)) {
57+
return true;
58+
}
59+
}
60+
61+
return false;
62+
}
63+
64+
/**
65+
* {@inheritdoc}
66+
*/
67+
public function needsRehash(string $encoded): bool
68+
{
69+
return $this->bestEncoder->needsRehash($encoded);
70+
}
71+
}

‎src/Symfony/Component/Security/Core/Encoder/NativePasswordEncoder.php

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,4 +87,12 @@ public function isPasswordValid($encoded, $raw, $salt)
8787

8888
return \strlen($raw) <= self::MAX_PASSWORD_LENGTH && password_verify($raw, $encoded);
8989
}
90+
91+
/**
92+
* {@inheritdoc}
93+
*/
94+
public function needsRehash(string $encoded): bool
95+
{
96+
return password_needs_rehash($encoded, $this->algo, $this->options);
97+
}
9098
}

‎src/Symfony/Component/Security/Core/Encoder/PasswordEncoderInterface.php

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,8 @@
1717
* PasswordEncoderInterface is the interface for all encoders.
1818
*
1919
* @author Fabien Potencier <fabien@symfony.com>
20+
*
21+
* @method bool needsRehash(string $encoded)
2022
*/
2123
interface PasswordEncoderInterface
2224
{

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy