7 files changed, 20 insertions, 86 deletions
diff --git a/phpBB/phpbb/auth/provider/db.php b/phpBB/phpbb/auth/provider/db.php
index 3be1d3873f..142a47247f 100644
--- a/phpBB/phpbb/auth/provider/db.php
+++ b/phpBB/phpbb/auth/provider/db.php
@@ -78,7 +78,7 @@ class db extends \phpbb\auth\provider\base
 
 		$username_clean = utf8_clean_string($username);
 
-		$sql = 'SELECT user_id, username, user_password, user_passchg, user_pass_convert, user_email, user_type, user_login_attempts
+		$sql = 'SELECT user_id, username, user_password, user_passchg, user_email, user_type, user_login_attempts
 			FROM ' . USERS_TABLE . "
 			WHERE username_clean = '" . $this->db->sql_escape($username_clean) . "'";
 		$result = $this->db->sql_query($sql);
@@ -170,72 +170,8 @@ class db extends \phpbb\auth\provider\base
 
 		}
 
-		// If the password convert flag is set we need to convert it
-		if ($row['user_pass_convert'])
-		{
-			// enable super globals to get literal value
-			// this is needed to prevent unicode normalization
-			$super_globals_disabled = $this->request->super_globals_disabled();
-			if ($super_globals_disabled)
-			{
-				$this->request->enable_super_globals();
-			}
-
-			// in phpBB2 passwords were used exactly as they were sent, with addslashes applied
-			$password_old_format = isset($_REQUEST['password']) ? (string) $_REQUEST['password'] : '';
-			$password_old_format = (!STRIP) ? addslashes($password_old_format) : $password_old_format;
-			$password_new_format = $this->request->variable('password', '', true);
-
-			if ($super_globals_disabled)
-			{
-				$this->request->disable_super_globals();
-			}
-
-			if ($password == $password_new_format)
-			{
-				if (!function_exists('utf8_to_cp1252'))
-				{
-					include($this->phpbb_root_path . 'includes/utf/data/recode_basic.' . $this->php_ext);
-				}
-
-				// cp1252 is phpBB2's default encoding, characters outside ASCII range might work when converted into that encoding
-				// plain md5 support left in for conversions from other systems.
-				if ((strlen($row['user_password']) == 34 && ($this->passwords_manager->check(md5($password_old_format), $row['user_password']) || $this->passwords_manager->check(md5(utf8_to_cp1252($password_old_format)), $row['user_password'])))
-					|| (strlen($row['user_password']) == 32  && (md5($password_old_format) == $row['user_password'] || md5(utf8_to_cp1252($password_old_format)) == $row['user_password'])))
-				{
-					$hash = $this->passwords_manager->hash($password_new_format);
-
-					// Update the password in the users table to the new format and remove user_pass_convert flag
-					$sql = 'UPDATE ' . USERS_TABLE . '
-						SET user_password = \'' . $this->db->sql_escape($hash) . '\',
-							user_pass_convert = 0
-						WHERE user_id = ' . $row['user_id'];
-					$this->db->sql_query($sql);
-
-					$row['user_pass_convert'] = 0;
-					$row['user_password'] = $hash;
-				}
-				else
-				{
-					// Although we weren't able to convert this password we have to
-					// increase login attempt count to make sure this cannot be exploited
-					$sql = 'UPDATE ' . USERS_TABLE . '
-						SET user_login_attempts = user_login_attempts + 1
-						WHERE user_id = ' . (int) $row['user_id'] . '
-							AND user_login_attempts < ' . LOGIN_ATTEMPTS_MAX;
-					$this->db->sql_query($sql);
-
-					return array(
-						'status'		=> LOGIN_ERROR_PASSWORD_CONVERT,
-						'error_msg'		=> 'LOGIN_ERROR_PASSWORD_CONVERT',
-						'user_row'		=> $row,
-					);
-				}
-			}
-		}
-
 		// Check password ...
-		if (!$row['user_pass_convert'] && $this->passwords_manager->check($password, $row['user_password']))
+		if ($this->passwords_manager->check($password, $row['user_password']))
 		{
 			// Check for old password hash...
 			if ($this->passwords_manager->convert_flag || strlen($row['user_password']) == 32)
@@ -244,8 +180,7 @@ class db extends \phpbb\auth\provider\base
 
 				// Update the password in the users table to the new format
 				$sql = 'UPDATE ' . USERS_TABLE . "
-					SET user_password = '" . $this->db->sql_escape($hash) . "',
-						user_pass_convert = 0
+					SET user_password = '" . $this->db->sql_escape($hash) . "'
 					WHERE user_id = {$row['user_id']}";
 				$this->db->sql_query($sql);
 
diff --git a/phpBB/phpbb/auth/provider/oauth/oauth.php b/phpBB/phpbb/auth/provider/oauth/oauth.php
index 2230ce15d1..7b71e3c844 100644
--- a/phpBB/phpbb/auth/provider/oauth/oauth.php
+++ b/phpBB/phpbb/auth/provider/oauth/oauth.php
@@ -14,7 +14,6 @@
 namespace phpbb\auth\provider\oauth;
 
 use OAuth\Common\Consumer\Credentials;
-use OAuth\Common\Http\Uri\Uri;
 
 /**
 * OAuth authentication provider for phpBB3
@@ -215,7 +214,7 @@ class oauth extends \phpbb\auth\provider\base
 			}
 
 			// Retrieve the user's account
-			$sql = 'SELECT user_id, username, user_password, user_passchg, user_pass_convert, user_email, user_type, user_login_attempts
+			$sql = 'SELECT user_id, username, user_password, user_passchg, user_email, user_type, user_login_attempts
 				FROM ' . $this->users_table . '
 					WHERE user_id = ' . (int) $row['user_id'];
 			$result = $this->db->sql_query($sql);
@@ -224,7 +223,7 @@ class oauth extends \phpbb\auth\provider\base
 
 			if (!$row)
 			{
-				throw new Exception('AUTH_PROVIDER_OAUTH_ERROR_INVALID_ENTRY');
+				throw new \Exception('AUTH_PROVIDER_OAUTH_ERROR_INVALID_ENTRY');
 			}
 
 			// Update token storage to store the user_id
@@ -278,9 +277,10 @@ class oauth extends \phpbb\auth\provider\base
 	* @param	array	$service_credentials	{@see \phpbb\auth\provider\oauth\oauth::get_service_credentials}
 	* @param	string	$query					The query string of the
 	*											current_uri used in redirection
-	* @param	array	$scope					The scope of the request against
+	* @param	array	$scopes					The scope of the request against
 	*											the api.
 	* @return	\OAuth\Common\Service\ServiceInterface
+	* @throws	\Exception
 	*/
 	protected function get_service($service_name, \phpbb\auth\provider\oauth\token_storage $storage, array $service_credentials, $query, array $scopes = array())
 	{
@@ -298,7 +298,7 @@ class oauth extends \phpbb\auth\provider\base
 
 		if (!$service)
 		{
-			throw new Exception('AUTH_PROVIDER_OAUTH_ERROR_SERVICE_NOT_CREATED');
+			throw new \Exception('AUTH_PROVIDER_OAUTH_ERROR_SERVICE_NOT_CREATED');
 		}
 
 		return $service;
@@ -617,7 +617,5 @@ class oauth extends \phpbb\auth\provider\base
 		$service_name = 'auth.provider.oauth.service.' . strtolower($link_data['oauth_service']);
 		$storage = new \phpbb\auth\provider\oauth\token_storage($this->db, $this->user, $this->auth_provider_oauth_token_storage_table);
 		$storage->clearToken($service_name);
-
-		return;
 	}
 }
diff --git a/phpBB/phpbb/auth/provider/oauth/service/facebook.php b/phpBB/phpbb/auth/provider/oauth/service/facebook.php
index 31060c4ac4..bb98835e07 100644
--- a/phpBB/phpbb/auth/provider/oauth/service/facebook.php
+++ b/phpBB/phpbb/auth/provider/oauth/service/facebook.php
@@ -21,22 +21,22 @@ class facebook extends base
 	/**
 	* phpBB config
 	*
-	* @var phpbb\config\config
+	* @var \phpbb\config\config
 	*/
 	protected $config;
 
 	/**
 	* phpBB request
 	*
-	* @var phpbb\request\request_interface
+	* @var \phpbb\request\request_interface
 	*/
 	protected $request;
 
 	/**
 	* Constructor
 	*
-	* @param	phpbb\config\config					$config
-	* @param	phpbb\request\request_interface 	$request
+	* @param	\phpbb\config\config				$config
+	* @param	\phpbb\request\request_interface 	$request
 	*/
 	public function __construct(\phpbb\config\config $config, \phpbb\request\request_interface $request)
 	{
diff --git a/phpBB/phpbb/auth/provider/oauth/service/google.php b/phpBB/phpbb/auth/provider/oauth/service/google.php
index c2d9e1f798..cb9f83a94f 100644
--- a/phpBB/phpbb/auth/provider/oauth/service/google.php
+++ b/phpBB/phpbb/auth/provider/oauth/service/google.php
@@ -21,22 +21,22 @@ class google extends base
 	/**
 	* phpBB config
 	*
-	* @var phpbb\config\config
+	* @var \phpbb\config\config
 	*/
 	protected $config;
 
 	/**
 	* phpBB request
 	*
-	* @var phpbb\request\request_interface
+	* @var \phpbb\request\request_interface
 	*/
 	protected $request;
 
 	/**
 	* Constructor
 	*
-	* @param	phpbb\config\config					$config
-	* @param	phpbb\request\request_interface 	$request
+	* @param	\phpbb\config\config				$config
+	* @param	\phpbb\request\request_interface 	$request
 	*/
 	public function __construct(\phpbb\config\config $config, \phpbb\request\request_interface $request)
 	{
diff --git a/phpBB/phpbb/auth/provider/oauth/service/service_interface.php b/phpBB/phpbb/auth/provider/oauth/service/service_interface.php
index 3744582b95..e84eb247b6 100644
--- a/phpBB/phpbb/auth/provider/oauth/service/service_interface.php
+++ b/phpBB/phpbb/auth/provider/oauth/service/service_interface.php
@@ -67,7 +67,7 @@ interface service_interface
 	/**
 	* Sets the external library service provider
 	*
-	* @param	\OAuth\Common\Service\ServiceInterface	$service
+	* @param	\OAuth\Common\Service\ServiceInterface	$service_provider
 	*/
 	public function set_external_service_provider(\OAuth\Common\Service\ServiceInterface $service_provider);
 }
diff --git a/phpBB/phpbb/auth/provider/oauth/token_storage.php b/phpBB/phpbb/auth/provider/oauth/token_storage.php
index b7d32bf246..fe1a376cfe 100644
--- a/phpBB/phpbb/auth/provider/oauth/token_storage.php
+++ b/phpBB/phpbb/auth/provider/oauth/token_storage.php
@@ -17,7 +17,6 @@ namespace phpbb\auth\provider\oauth;
 use OAuth\OAuth1\Token\StdOAuth1Token;
 use OAuth\Common\Token\TokenInterface;
 use OAuth\Common\Storage\TokenStorageInterface;
-use OAuth\Common\Storage\Exception\StorageException;
 use OAuth\Common\Storage\Exception\TokenNotFoundException;
 
 /**
@@ -198,6 +197,7 @@ class token_storage implements TokenStorageInterface
 	/**
 	* Checks to see if an access token exists solely by the session_id of the user
 	*
+	* @param	string	$service	The name of the OAuth service
 	* @return	bool	true if they have token, false if they don't
 	*/
 	public function has_access_token_by_session($service)
@@ -250,6 +250,7 @@ class token_storage implements TokenStorageInterface
 	*
 	* @param	array	$data
 	* @return	mixed
+	* @throws \OAuth\Common\Storage\Exception\TokenNotFoundException
 	*/
 	protected function _retrieve_access_token($data)
 	{
diff --git a/phpBB/phpbb/auth/provider/provider_interface.php b/phpBB/phpbb/auth/provider/provider_interface.php
index 140353c88b..613297cefc 100644
--- a/phpBB/phpbb/auth/provider/provider_interface.php
+++ b/phpBB/phpbb/auth/provider/provider_interface.php
@@ -148,7 +148,7 @@ interface provider_interface
 	* user_id of an account needed to successfully link an external account to
 	* a forum account.
 	*
-	* @param	array	$link_data	Any data needed to link a phpBB account to
+	* @param	array	$login_link_data	Any data needed to link a phpBB account to
 	*								an external account.
 	* @return	string|null	Returns a string with a language constant if there
 	*						is data missing or null if there is no error.