16 files changed, 1208 insertions, 0 deletions
diff --git a/phpBB/phpbb/passwords/driver/base.php b/phpBB/phpbb/passwords/driver/base.php
new file mode 100644
index 0000000000..fd07a61bf4
--- /dev/null
+++ b/phpBB/phpbb/passwords/driver/base.php
@@ -0,0 +1,62 @@
+<?php
+/**
+*
+* This file is part of the phpBB Forum Software package.
+*
+* @copyright (c) phpBB Limited <https://www.phpbb.com>
+* @license GNU General Public License, version 2 (GPL-2.0)
+*
+* For full copyright and license information, please see
+* the docs/CREDITS.txt file.
+*
+*/
+
+namespace phpbb\passwords\driver;
+
+abstract class base implements driver_interface
+{
+	/** @var \phpbb\config\config */
+	protected $config;
+
+	/** @var \phpbb\passwords\driver\helper */
+	protected $helper;
+
+	/** @var driver name */
+	protected $name;
+
+	/**
+	* Constructor of passwords driver object
+	*
+	* @param \phpbb\config\config $config phpBB config
+	* @param \phpbb\passwords\driver\helper $helper Password driver helper
+	*/
+	public function __construct(\phpbb\config\config $config, helper $helper)
+	{
+		$this->config = $config;
+		$this->helper = $helper;
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function is_supported()
+	{
+		return true;
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function is_legacy()
+	{
+		return false;
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function get_settings_only($hash, $full = false)
+	{
+		return false;
+	}
+}
diff --git a/phpBB/phpbb/passwords/driver/bcrypt.php b/phpBB/phpbb/passwords/driver/bcrypt.php
new file mode 100644
index 0000000000..23add37a56
--- /dev/null
+++ b/phpBB/phpbb/passwords/driver/bcrypt.php
@@ -0,0 +1,105 @@
+<?php
+/**
+*
+* This file is part of the phpBB Forum Software package.
+*
+* @copyright (c) phpBB Limited <https://www.phpbb.com>
+* @license GNU General Public License, version 2 (GPL-2.0)
+*
+* For full copyright and license information, please see
+* the docs/CREDITS.txt file.
+*
+*/
+
+namespace phpbb\passwords\driver;
+
+class bcrypt extends base
+{
+	const PREFIX = '$2a$';
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function get_prefix()
+	{
+		return self::PREFIX;
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function hash($password, $salt = '')
+	{
+		// The 2x and 2y prefixes of bcrypt might not be supported
+		// Revert to 2a if this is the case
+		$prefix = (!$this->is_supported()) ? '$2a$' : $this->get_prefix();
+
+		// Do not support 8-bit characters with $2a$ bcrypt
+		// Also see http://www.php.net/security/crypt_blowfish.php
+		if ($prefix === self::PREFIX)
+		{
+			if (ord($password[strlen($password)-1]) & 128)
+			{
+				return false;
+			}
+		}
+
+		if ($salt == '')
+		{
+			$salt = $prefix . '10$' . $this->get_random_salt();
+		}
+
+		$hash = crypt($password, $salt);
+		if (strlen($hash) < 60)
+		{
+			return false;
+		}
+		return $hash;
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function check($password, $hash, $user_row = array())
+	{
+		$salt = substr($hash, 0, 29);
+		if (strlen($salt) != 29)
+		{
+			return false;
+		}
+
+		if ($hash == $this->hash($password, $salt))
+		{
+			return true;
+		}
+		return false;
+	}
+
+	/**
+	* Get a random salt value with a length of 22 characters
+	*
+	* @return string Salt for password hashing
+	*/
+	protected function get_random_salt()
+	{
+		return $this->helper->hash_encode64($this->helper->get_random_salt(22), 22);
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function get_settings_only($hash, $full = false)
+	{
+		if ($full)
+		{
+			$pos = stripos($hash, '$', 1) + 1;
+			$length = 22 + (strripos($hash, '$') + 1 - $pos);
+		}
+		else
+		{
+			$pos = strripos($hash, '$') + 1;
+			$length = 22;
+		}
+		return substr($hash, $pos, $length);
+	}
+}
diff --git a/phpBB/phpbb/passwords/driver/bcrypt_2y.php b/phpBB/phpbb/passwords/driver/bcrypt_2y.php
new file mode 100644
index 0000000000..c710e0d04a
--- /dev/null
+++ b/phpBB/phpbb/passwords/driver/bcrypt_2y.php
@@ -0,0 +1,35 @@
+<?php
+/**
+*
+* This file is part of the phpBB Forum Software package.
+*
+* @copyright (c) phpBB Limited <https://www.phpbb.com>
+* @license GNU General Public License, version 2 (GPL-2.0)
+*
+* For full copyright and license information, please see
+* the docs/CREDITS.txt file.
+*
+*/
+
+namespace phpbb\passwords\driver;
+
+class bcrypt_2y extends bcrypt
+{
+	const PREFIX = '$2y$';
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function get_prefix()
+	{
+		return self::PREFIX;
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function is_supported()
+	{
+		return (version_compare(PHP_VERSION, '5.3.7', '<')) ? false : true;
+	}
+}
diff --git a/phpBB/phpbb/passwords/driver/bcrypt_wcf2.php b/phpBB/phpbb/passwords/driver/bcrypt_wcf2.php
new file mode 100644
index 0000000000..2d6f897a7b
--- /dev/null
+++ b/phpBB/phpbb/passwords/driver/bcrypt_wcf2.php
@@ -0,0 +1,84 @@
+<?php
+/**
+*
+* This file is part of the phpBB Forum Software package.
+*
+* @copyright (c) phpBB Limited <https://www.phpbb.com>
+* @license GNU General Public License, version 2 (GPL-2.0)
+*
+* For full copyright and license information, please see
+* the docs/CREDITS.txt file.
+*
+*/
+
+namespace phpbb\passwords\driver;
+
+class bcrypt_wcf2 extends base
+{
+	const PREFIX = '$wcf2$';
+
+	/** @var \phpbb\passwords\driver\bcrypt */
+	protected $bcrypt;
+
+	/** @var \phpbb\passwords\driver\helper */
+	protected $helper;
+
+	/**
+	* Constructor of passwords driver object
+	*
+	* @param \phpbb\passwords\driver\bcrypt $bcrypt Salted md5 driver
+	* @param \phpbb\passwords\driver\helper $helper Password driver helper
+	*/
+	public function __construct(\phpbb\passwords\driver\bcrypt $bcrypt, helper $helper)
+	{
+		$this->bcrypt = $bcrypt;
+		$this->helper = $helper;
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function get_prefix()
+	{
+		return self::PREFIX;
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function is_legacy()
+	{
+		return true;
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function hash($password, $user_row = '')
+	{
+		// Do not support hashing
+		return false;
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function check($password, $hash, $user_row = array())
+	{
+		if (empty($hash) || strlen($hash) != 60)
+		{
+			return false;
+		}
+		else
+		{
+			$salt = substr($hash, 0, 29);
+
+			if (strlen($salt) != 29)
+			{
+				return false;
+			}
+			// Works for standard WCF 2.x, i.e. WBB4 and similar
+			return $hash === $this->bcrypt->hash($this->bcrypt->hash($password, $salt), $salt);
+		}
+	}
+}
diff --git a/phpBB/phpbb/passwords/driver/convert_password.php b/phpBB/phpbb/passwords/driver/convert_password.php
new file mode 100644
index 0000000000..eb70434df2
--- /dev/null
+++ b/phpBB/phpbb/passwords/driver/convert_password.php
@@ -0,0 +1,43 @@
+<?php
+/**
+*
+* This file is part of the phpBB Forum Software package.
+*
+* @copyright (c) phpBB Limited <https://www.phpbb.com>
+* @license GNU General Public License, version 2 (GPL-2.0)
+*
+* For full copyright and license information, please see
+* the docs/CREDITS.txt file.
+*
+*/
+
+namespace phpbb\passwords\driver;
+
+class convert_password extends base
+{
+	const PREFIX = '$CP$';
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function get_prefix()
+	{
+		return self::PREFIX;
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function hash($password, $user_row = '')
+	{
+		return false;
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function check($password, $hash, $user_row = array())
+	{
+		return false;
+	}
+}
diff --git a/phpBB/phpbb/passwords/driver/driver_interface.php b/phpBB/phpbb/passwords/driver/driver_interface.php
new file mode 100644
index 0000000000..3974484f13
--- /dev/null
+++ b/phpBB/phpbb/passwords/driver/driver_interface.php
@@ -0,0 +1,69 @@
+<?php
+/**
+*
+* This file is part of the phpBB Forum Software package.
+*
+* @copyright (c) phpBB Limited <https://www.phpbb.com>
+* @license GNU General Public License, version 2 (GPL-2.0)
+*
+* For full copyright and license information, please see
+* the docs/CREDITS.txt file.
+*
+*/
+
+namespace phpbb\passwords\driver;
+
+interface driver_interface
+{
+	/**
+	* Check if hash type is supported
+	*
+	* @return bool		True if supported, false if not
+	*/
+	public function is_supported();
+
+	/**
+	* Check if hash type is a legacy hash type
+	*
+	* @return bool		True if it's a legacy hash type, false if not
+	*/
+	public function is_legacy();
+
+	/**
+	* Returns the hash prefix
+	*
+	* @return string	Hash prefix
+	*/
+	public function get_prefix();
+
+	/**
+	* Hash the password
+	*
+	* @param string $password The password that should be hashed
+	*
+	* @return bool|string	Password hash or false if something went wrong
+	*			during hashing
+	*/
+	public function hash($password);
+
+	/**
+	* Check the password against the supplied hash
+	*
+	* @param string		$password The password to check
+	* @param string		$hash The password hash to check against
+	* @param array		$user_row User's row in users table
+	*
+	* @return bool		True if password is correct, else false
+	*/
+	public function check($password, $hash, $user_row = array());
+
+	/**
+	* Get only the settings of the specified hash
+	*
+	* @param string		$hash Password hash
+	* @param bool		$full Return full settings or only settings
+	*			related to the salt
+	* @return string	String containing the hash settings
+	*/
+	public function get_settings_only($hash, $full = false);
+}
diff --git a/phpBB/phpbb/passwords/driver/helper.php b/phpBB/phpbb/passwords/driver/helper.php
new file mode 100644
index 0000000000..2b3ebce53a
--- /dev/null
+++ b/phpBB/phpbb/passwords/driver/helper.php
@@ -0,0 +1,145 @@
+<?php
+/**
+*
+* This file is part of the phpBB Forum Software package.
+*
+* @copyright (c) phpBB Limited <https://www.phpbb.com>
+* @license GNU General Public License, version 2 (GPL-2.0)
+*
+* For full copyright and license information, please see
+* the docs/CREDITS.txt file.
+*
+*/
+
+namespace phpbb\passwords\driver;
+
+class helper
+{
+	/**
+	* @var \phpbb\config\config
+	*/
+	protected $config;
+
+	/**
+	* base64 alphabet
+	* @var string
+	*/
+	public $itoa64 = './0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz';
+
+	/**
+	* Construct a driver helper object
+	*
+	* @param \phpbb\config\config $config phpBB configuration
+	*/
+	public function __construct(\phpbb\config\config $config)
+	{
+		$this->config = $config;
+	}
+
+	/**
+	* Base64 encode hash
+	*
+	* @param string $input Input string
+	* @param int $count Input string length
+	*
+	* @return string base64 encoded string
+	*/
+	public function hash_encode64($input, $count)
+	{
+		$output = '';
+		$i = 0;
+
+		do
+		{
+			$value = ord($input[$i++]);
+			$output .= $this->itoa64[$value & 0x3f];
+
+			if ($i < $count)
+			{
+				$value |= ord($input[$i]) << 8;
+			}
+
+			$output .= $this->itoa64[($value >> 6) & 0x3f];
+
+			if ($i++ >= $count)
+			{
+				break;
+			}
+
+			if ($i < $count)
+			{
+				$value |= ord($input[$i]) << 16;
+			}
+
+			$output .= $this->itoa64[($value >> 12) & 0x3f];
+
+			if ($i++ >= $count)
+			{
+				break;
+			}
+
+			$output .= $this->itoa64[($value >> 18) & 0x3f];
+		}
+		while ($i < $count);
+
+		return $output;
+	}
+
+	/**
+	* Return unique id
+	*
+	* @param string $extra Additional entropy
+	*
+	* @return string Unique id
+	*/
+	public function unique_id($extra = 'c')
+	{
+		static $dss_seeded = false;
+
+		$val = $this->config['rand_seed'] . microtime();
+		$val = md5($val);
+		$this->config['rand_seed'] = md5($this->config['rand_seed'] . $val . $extra);
+
+		if ($dss_seeded !== true && ($this->config['rand_seed_last_update'] < time() - rand(1,10)))
+		{
+			$this->config->set('rand_seed_last_update', time(), true);
+			$this->config->set('rand_seed', $this->config['rand_seed'], true);
+			$dss_seeded = true;
+		}
+
+		return substr($val, 4, 16);
+	}
+
+	/**
+	* Get random salt with specified length
+	*
+	* @param int $length Salt length
+	* @param string $rand_seed Seed for random data (optional). For tests.
+	*
+	* @return string Random salt with specified length
+	*/
+	public function get_random_salt($length, $rand_seed = '/dev/urandom')
+	{
+		$random = '';
+
+		if (($fh = @fopen($rand_seed, 'rb')))
+		{
+			$random = fread($fh, $length);
+			fclose($fh);
+		}
+
+		if (strlen($random) < $length)
+		{
+			$random = '';
+			$random_state = $this->unique_id();
+
+			for ($i = 0; $i < $length; $i += 16)
+			{
+				$random_state = md5($this->unique_id() . $random_state);
+				$random .= pack('H*', md5($random_state));
+			}
+			$random = substr($random, 0, $length);
+		}
+		return $random;
+	}
+}
diff --git a/phpBB/phpbb/passwords/driver/md5_mybb.php b/phpBB/phpbb/passwords/driver/md5_mybb.php
new file mode 100644
index 0000000000..61ea8dafd8
--- /dev/null
+++ b/phpBB/phpbb/passwords/driver/md5_mybb.php
@@ -0,0 +1,60 @@
+<?php
+/**
+*
+* This file is part of the phpBB Forum Software package.
+*
+* @copyright (c) phpBB Limited <https://www.phpbb.com>
+* @license GNU General Public License, version 2 (GPL-2.0)
+*
+* For full copyright and license information, please see
+* the docs/CREDITS.txt file.
+*
+*/
+
+namespace phpbb\passwords\driver;
+
+class md5_mybb extends base
+{
+	const PREFIX = '$md5_mybb$';
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function get_prefix()
+	{
+		return self::PREFIX;
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function is_legacy()
+	{
+		return true;
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function hash($password, $user_row = '')
+	{
+		// Do not support hashing
+		return false;
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function check($password, $hash, $user_row = array())
+	{
+		if (empty($hash) || strlen($hash) != 32 || !isset($user_row['user_passwd_salt']))
+		{
+			return false;
+		}
+		else
+		{
+			// Works for myBB 1.1.x, 1.2.x, 1.4.x, 1.6.x
+			return $hash === md5(md5($user_row['user_passwd_salt']) . md5($password));
+		}
+	}
+}
diff --git a/phpBB/phpbb/passwords/driver/md5_phpbb2.php b/phpBB/phpbb/passwords/driver/md5_phpbb2.php
new file mode 100644
index 0000000000..86a4b62ea5
--- /dev/null
+++ b/phpBB/phpbb/passwords/driver/md5_phpbb2.php
@@ -0,0 +1,118 @@
+<?php
+/**
+*
+* This file is part of the phpBB Forum Software package.
+*
+* @copyright (c) phpBB Limited <https://www.phpbb.com>
+* @license GNU General Public License, version 2 (GPL-2.0)
+*
+* For full copyright and license information, please see
+* the docs/CREDITS.txt file.
+*
+*/
+
+namespace phpbb\passwords\driver;
+
+class md5_phpbb2 extends base
+{
+	const PREFIX = '$md5_phpbb2$';
+
+	/** @var \phpbb\request\request phpBB request object */
+	protected $request;
+
+	/** @var \phpbb\passwords\driver\salted_md5 */
+	protected $salted_md5;
+
+	/** @var string phpBB root path */
+	protected $phpbb_root_path;
+
+	/** @var string php file extension */
+	protected $php_ext;
+
+	/**
+	* Constructor of passwords driver object
+	*
+	* @param \phpbb\request\request $request phpBB request object
+	* @param \phpbb\passwords\driver\salted_md5 $salted_md5 Salted md5 driver
+	* @param string $phpbb_root_path phpBB root path
+	* @param string $php_ext PHP file extension
+	*/
+	public function __construct($request, \phpbb\passwords\driver\salted_md5 $salted_md5, $phpbb_root_path, $php_ext)
+	{
+		$this->request = $request;
+		$this->salted_md5 = $salted_md5;
+		$this->phpbb_root_path = $phpbb_root_path;
+		$this->php_ext = $php_ext;
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function get_prefix()
+	{
+		return self::PREFIX;
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function is_legacy()
+	{
+		return true;
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function hash($password, $user_row = '')
+	{
+		// Do not support hashing
+		return false;
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function check($password, $hash, $user_row = array())
+	{
+		if (strlen($hash) != 32 && strlen($hash) != 34)
+		{
+			return false;
+		}
+
+		// enable super globals to get literal value
+		// this is needed to prevent unicode normalization
+		$super_globals_disabled = $this->request->super_globals_disabled();
+		if ($super_globals_disabled)
+		{
+			$this->request->enable_super_globals();
+		}
+
+		// in phpBB2 passwords were used exactly as they were sent, with addslashes applied
+		$password_old_format = isset($_REQUEST['password']) ? (string) $_REQUEST['password'] : '';
+		$password_old_format = (!STRIP) ? addslashes($password_old_format) : $password_old_format;
+		$password_new_format = $this->request->variable('password', '', true);
+
+		if ($super_globals_disabled)
+		{
+			$this->request->disable_super_globals();
+		}
+
+		if ($password == $password_new_format)
+		{
+			if (!function_exists('utf8_to_cp1252'))
+			{
+				include($this->phpbb_root_path . 'includes/utf/data/recode_basic.' . $this->php_ext);
+			}
+
+			if (md5($password_old_format) === $hash || md5(\utf8_to_cp1252($password_old_format)) === $hash
+				|| $this->salted_md5->check(md5($password_old_format), $hash) === true
+				|| $this->salted_md5->check(md5(\utf8_to_cp1252($password_old_format)), $hash) === true)
+			{
+				return true;
+			}
+		}
+
+		return false;
+	}
+}
diff --git a/phpBB/phpbb/passwords/driver/md5_vb.php b/phpBB/phpbb/passwords/driver/md5_vb.php
new file mode 100644
index 0000000000..c83c32a596
--- /dev/null
+++ b/phpBB/phpbb/passwords/driver/md5_vb.php
@@ -0,0 +1,60 @@
+<?php
+/**
+*
+* This file is part of the phpBB Forum Software package.
+*
+* @copyright (c) phpBB Limited <https://www.phpbb.com>
+* @license GNU General Public License, version 2 (GPL-2.0)
+*
+* For full copyright and license information, please see
+* the docs/CREDITS.txt file.
+*
+*/
+
+namespace phpbb\passwords\driver;
+
+class md5_vb extends base
+{
+	const PREFIX = '$md5_vb$';
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function get_prefix()
+	{
+		return self::PREFIX;
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function is_legacy()
+	{
+		return true;
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function hash($password, $user_row = '')
+	{
+		// Do not support hashing
+		return false;
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function check($password, $hash, $user_row = array())
+	{
+		if (empty($hash) || strlen($hash) != 32 || !isset($user_row['user_passwd_salt']))
+		{
+			return false;
+		}
+		else
+		{
+			// Works for vB 3.8.x, 4.x.x, 5.0.x
+			return $hash === md5(md5($password) . $user_row['user_passwd_salt']);
+		}
+	}
+}
diff --git a/phpBB/phpbb/passwords/driver/phpass.php b/phpBB/phpbb/passwords/driver/phpass.php
new file mode 100644
index 0000000000..bef8355276
--- /dev/null
+++ b/phpBB/phpbb/passwords/driver/phpass.php
@@ -0,0 +1,27 @@
+<?php
+/**
+*
+* This file is part of the phpBB Forum Software package.
+*
+* @copyright (c) phpBB Limited <https://www.phpbb.com>
+* @license GNU General Public License, version 2 (GPL-2.0)
+*
+* For full copyright and license information, please see
+* the docs/CREDITS.txt file.
+*
+*/
+
+namespace phpbb\passwords\driver;
+
+class phpass extends salted_md5
+{
+	const PREFIX = '$P$';
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function get_prefix()
+	{
+		return self::PREFIX;
+	}
+}
diff --git a/phpBB/phpbb/passwords/driver/salted_md5.php b/phpBB/phpbb/passwords/driver/salted_md5.php
new file mode 100644
index 0000000000..97a2b9154b
--- /dev/null
+++ b/phpBB/phpbb/passwords/driver/salted_md5.php
@@ -0,0 +1,169 @@
+<?php
+/**
+*
+* This file is part of the phpBB Forum Software package.
+*
+* @copyright (c) phpBB Limited <https://www.phpbb.com>
+* @license GNU General Public License, version 2 (GPL-2.0)
+*
+* For full copyright and license information, please see
+* the docs/CREDITS.txt file.
+*
+*/
+
+namespace phpbb\passwords\driver;
+
+/**
+*
+* @version Version 0.1 / slightly modified for phpBB 3.1.x (using $H$ as hash type identifier)
+*
+* Portable PHP password hashing framework.
+*
+* Written by Solar Designer <solar at openwall.com> in 2004-2006 and placed in
+* the public domain.
+*
+* There's absolutely no warranty.
+*
+* The homepage URL for this framework is:
+*
+*	http://www.openwall.com/phpass/
+*
+* Please be sure to update the Version line if you edit this file in any way.
+* It is suggested that you leave the main version number intact, but indicate
+* your project name (after the slash) and add your own revision information.
+*
+* Please do not change the "private" password hashing method implemented in
+* here, thereby making your hashes incompatible.  However, if you must, please
+* change the hash type identifier (the "$P$") to something different.
+*
+* Obviously, since this code is in the public domain, the above are not
+* requirements (there can be none), but merely suggestions.
+*
+*/
+
+class salted_md5 extends base
+{
+	const PREFIX = '$H$';
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function get_prefix()
+	{
+		return self::PREFIX;
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function is_legacy()
+	{
+		return true;
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function hash($password, $setting = '')
+	{
+		if ($setting)
+		{
+			if (($settings = $this->get_hash_settings($setting)) === false)
+			{
+				// Return md5 of password if settings do not
+				// comply with our standards. This will only
+				// happen if pre-determined settings are
+				// directly passed to the driver. The manager
+				// will not do this. Same as the old hashing
+				// implementatio in phpBB 3.0
+				return md5($password);
+			}
+		}
+		else
+		{
+			$settings = $this->get_hash_settings($this->generate_salt());
+		}
+
+		$hash = md5($settings['salt'] . $password, true);
+		do
+		{
+			$hash = md5($hash . $password, true);
+		}
+		while (--$settings['count']);
+
+		$output = $settings['full'];
+		$output .= $this->helper->hash_encode64($hash, 16);
+
+		return $output;
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function check($password, $hash, $user_row = array())
+	{
+		if (strlen($hash) !== 34)
+		{
+			return md5($password) === $hash;
+		}
+
+		return $hash === $this->hash($password, $hash);
+	}
+
+	/**
+	* Generate salt for hashing method
+	*
+	* @return string Salt for hashing method
+	*/
+	protected function generate_salt()
+	{
+		$count = 6;
+
+		$random = $this->helper->get_random_salt($count);
+
+		$salt = $this->get_prefix();
+		$salt .= $this->helper->itoa64[min($count + 5, 30)];
+		$salt .= $this->helper->hash_encode64($random, $count);
+
+		return $salt;
+	}
+
+	/**
+	* Get hash settings
+	*
+	* @param string $hash The hash that contains the settings
+	*
+	* @return bool|array Array containing the count_log2, salt, and full
+	*		hash settings string or false if supplied hash is empty
+	*		or contains incorrect settings
+	*/
+	public function get_hash_settings($hash)
+	{
+		if (empty($hash))
+		{
+			return false;
+		}
+
+		$count_log2 = strpos($this->helper->itoa64, $hash[3]);
+		$salt = substr($hash, 4, 8);
+
+		if ($count_log2 < 7 || $count_log2 > 30 || strlen($salt) != 8)
+		{
+			return false;
+		}
+
+		return array(
+			'count'	=> 1 << $count_log2,
+			'salt'	=> $salt,
+			'full'	=> substr($hash, 0, 12),
+		);
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function get_settings_only($hash, $full = false)
+	{
+		return substr($hash, 3, 9);
+	}
+}
diff --git a/phpBB/phpbb/passwords/driver/sha1.php b/phpBB/phpbb/passwords/driver/sha1.php
new file mode 100644
index 0000000000..0852fd32fc
--- /dev/null
+++ b/phpBB/phpbb/passwords/driver/sha1.php
@@ -0,0 +1,52 @@
+<?php
+/**
+*
+* This file is part of the phpBB Forum Software package.
+*
+* @copyright (c) phpBB Limited <https://www.phpbb.com>
+* @license GNU General Public License, version 2 (GPL-2.0)
+*
+* For full copyright and license information, please see
+* the docs/CREDITS.txt file.
+*
+*/
+
+namespace phpbb\passwords\driver;
+
+class sha1 extends base
+{
+	const PREFIX = '$sha1$';
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function get_prefix()
+	{
+		return self::PREFIX;
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function is_legacy()
+	{
+		return true;
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function hash($password, $user_row = '')
+	{
+		// Do not support hashing
+		return false;
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function check($password, $hash, $user_row = array())
+	{
+		return (strlen($hash) == 40) ? $hash === sha1($password) : false;
+	}
+}
diff --git a/phpBB/phpbb/passwords/driver/sha1_smf.php b/phpBB/phpbb/passwords/driver/sha1_smf.php
new file mode 100644
index 0000000000..ec64bd6afb
--- /dev/null
+++ b/phpBB/phpbb/passwords/driver/sha1_smf.php
@@ -0,0 +1,51 @@
+<?php
+/**
+*
+* This file is part of the phpBB Forum Software package.
+*
+* @copyright (c) phpBB Limited <https://www.phpbb.com>
+* @license GNU General Public License, version 2 (GPL-2.0)
+*
+* For full copyright and license information, please see
+* the docs/CREDITS.txt file.
+*
+*/
+
+namespace phpbb\passwords\driver;
+
+class sha1_smf extends base
+{
+	const PREFIX = '$smf$';
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function get_prefix()
+	{
+		return self::PREFIX;
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function is_legacy()
+	{
+		return true;
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function hash($password, $user_row = '')
+	{
+		return (isset($user_row['login_name'])) ? sha1(strtolower($user_row['login_name']) . $password) : false;
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function check($password, $hash, $user_row = array())
+	{
+		return (strlen($hash) == 40) ? $hash === $this->hash($password, $user_row) : false;
+	}
+}
diff --git a/phpBB/phpbb/passwords/driver/sha1_wcf1.php b/phpBB/phpbb/passwords/driver/sha1_wcf1.php
new file mode 100644
index 0000000000..919fa2bb71
--- /dev/null
+++ b/phpBB/phpbb/passwords/driver/sha1_wcf1.php
@@ -0,0 +1,60 @@
+<?php
+/**
+*
+* This file is part of the phpBB Forum Software package.
+*
+* @copyright (c) phpBB Limited <https://www.phpbb.com>
+* @license GNU General Public License, version 2 (GPL-2.0)
+*
+* For full copyright and license information, please see
+* the docs/CREDITS.txt file.
+*
+*/
+
+namespace phpbb\passwords\driver;
+
+class sha1_wcf1 extends base
+{
+	const PREFIX = '$wcf1$';
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function get_prefix()
+	{
+		return self::PREFIX;
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function is_legacy()
+	{
+		return true;
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function hash($password, $user_row = '')
+	{
+		// Do not support hashing
+		return false;
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function check($password, $hash, $user_row = array())
+	{
+		if (empty($hash) || strlen($hash) != 40 || !isset($user_row['user_passwd_salt']))
+		{
+			return false;
+		}
+		else
+		{
+			// Works for standard WCF 1.x, i.e. WBB3 and similar
+			return $hash === sha1($user_row['user_passwd_salt'] . sha1($user_row['user_passwd_salt'] . sha1($password)));
+		}
+	}
+}
diff --git a/phpBB/phpbb/passwords/driver/sha_xf1.php b/phpBB/phpbb/passwords/driver/sha_xf1.php
new file mode 100644
index 0000000000..7a1ea1450a
--- /dev/null
+++ b/phpBB/phpbb/passwords/driver/sha_xf1.php
@@ -0,0 +1,68 @@
+<?php
+/**
+*
+* This file is part of the phpBB Forum Software package.
+*
+* @copyright (c) phpBB Limited <https://www.phpbb.com>
+* @license GNU General Public License, version 2 (GPL-2.0)
+*
+* For full copyright and license information, please see
+* the docs/CREDITS.txt file.
+*
+*/
+
+namespace phpbb\passwords\driver;
+
+class sha_xf1 extends base
+{
+	const PREFIX = '$xf1$';
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function get_prefix()
+	{
+		return self::PREFIX;
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function is_legacy()
+	{
+		return true;
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function hash($password, $user_row = '')
+	{
+		// Do not support hashing
+		return false;
+	}
+
+	/**
+	* {@inheritdoc}
+	*/
+	public function check($password, $hash, $user_row = array())
+	{
+		if (empty($hash) || (strlen($hash) != 40 && strlen($hash) != 64) || !isset($user_row['user_passwd_salt']))
+		{
+			return false;
+		}
+		else
+		{
+			// Works for xenforo 1.0, 1.1
+			if ($hash === sha1(sha1($password) . $user_row['user_passwd_salt'])
+				|| $hash === hash('sha256', hash('sha256', $password) . $user_row['user_passwd_salt']))
+			{
+				return true;
+			}
+			else
+			{
+				return false;
+			}
+		}
+	}
+}