diff options
author | plegall <plg@piwigo.org> | 2015-12-30 16:21:32 +0100 |
---|---|---|
committer | plegall <plg@piwigo.org> | 2015-12-30 16:21:32 +0100 |
commit | 3ec3cbe6cec5968d29cb11af139123191f4cb4ee (patch) | |
tree | 34aecd51071d63f8df1862a1a11898d8c43fe68a /include/passwordhash.class.php | |
parent | 6ba0148e646b2a193dc4111bb0a443d8c193e646 (diff) | |
parent | 1681b02ee98c2deb740d394280a2a685170bc72e (diff) |
Merge branch 'bug/385-php7'
Diffstat (limited to '')
-rw-r--r-- | include/passwordhash.class.php | 57 |
1 files changed, 40 insertions, 17 deletions
diff --git a/include/passwordhash.class.php b/include/passwordhash.class.php index 84447b277..8b8b11319 100644 --- a/include/passwordhash.class.php +++ b/include/passwordhash.class.php @@ -1,18 +1,18 @@ <?php -# -# Portable PHP password hashing framework. -# -# Version 0.3 / genuine. +/** + * Portable PHP password hashing framework. + * @package phpass + * @since 2.5.0 + * @version 0.3 / WordPress + * @link http://www.openwall.com/phpass/ + */ + # # Written by Solar Designer <solar at openwall.com> in 2004-2006 and placed in # the public domain. Revised in subsequent years, still public domain. # # There's absolutely no warranty. # -# The homepage URL for this framework is: -# -# http://www.openwall.com/phpass/ -# # Please be sure to update the Version line if you edit this file in any way. # It is suggested that you leave the main version number intact, but indicate # your project name (after the slash) and add your own revision information. @@ -24,13 +24,25 @@ # Obviously, since this code is in the public domain, the above are not # requirements (there can be none), but merely suggestions. # + +/** + * Portable PHP password hashing framework. + * + * @package phpass + * @version 0.3 / WordPress + * @link http://www.openwall.com/phpass/ + * @since 2.5.0 + */ class PasswordHash { var $itoa64; var $iteration_count_log2; var $portable_hashes; var $random_state; - function PasswordHash($iteration_count_log2, $portable_hashes) + /** + * PHP5 constructor. + */ + function __construct( $iteration_count_log2, $portable_hashes ) { $this->itoa64 = './0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz'; @@ -40,15 +52,20 @@ class PasswordHash { $this->portable_hashes = $portable_hashes; - $this->random_state = microtime(); - if (function_exists('getmypid')) - $this->random_state .= getmypid(); + $this->random_state = microtime() . uniqid(rand(), TRUE); // removed getmypid() for compatibility reasons + } + + /** + * PHP4 constructor. + */ + public function PasswordHash( $iteration_count_log2, $portable_hashes ) { + self::__construct( $iteration_count_log2, $portable_hashes ); } function get_random_bytes($count) { $output = ''; - if (@is_readable('/dev/urandom') && + if ( @is_readable('/dev/urandom') && ($fh = @fopen('/dev/urandom', 'rb'))) { $output = fread($fh, $count); fclose($fh); @@ -207,6 +224,10 @@ class PasswordHash { function HashPassword($password) { + if ( strlen( $password ) > 4096 ) { + return '*'; + } + $random = ''; if (CRYPT_BLOWFISH == 1 && !$this->portable_hashes) { @@ -242,12 +263,14 @@ class PasswordHash { function CheckPassword($password, $stored_hash) { + if ( strlen( $password ) > 4096 ) { + return false; + } + $hash = $this->crypt_private($password, $stored_hash); if ($hash[0] == '*') $hash = crypt($password, $stored_hash); - return $hash == $stored_hash; + return $hash === $stored_hash; } -} - -?> +}
\ No newline at end of file |