aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* [feature/passwords] Properly set convert_flag and add test for itMarc Alexander2013-09-142-1/+8
| | | | PHPBB3-11610
* [feature/passwords] Define default hashing algorithm in container fileMarc Alexander2013-09-144-10/+15
| | | | | | | | | The default hashing algorithm type is defined as a parameter in the service definition file for the password hashing system. This will allow us to change this in the future but it will also prevent unexperienced admins from changing the hashing algorithm. PHPBB3-11610
* [feature/passwords] Add get_name() method to driversMarc Alexander2013-09-143-0/+36
| | | | | | | This will allow us to actually properly differentiate between the available drivers. PHPBB3-11610
* [feature/passwords] Move migrations file to phpbb folderMarc Alexander2013-09-141-0/+0
| | | | PHPBB3-11610
* [feature/passwords] Move files after namespacing changesMarc Alexander2013-09-1410-5/+5
| | | | PHPBB3-11610
* [feature/passwords] Add legacy support for md5 passwordsMarc Alexander2013-09-143-4/+4
| | | | PHPBB3-11610
* [feature/passwords] Increase code coverage in bcrypt driverMarc Alexander2013-09-141-0/+1
| | | | PHPBB3-11610
* [feature/passwords] Increase test coverage of salted_md5 driverMarc Alexander2013-09-141-0/+2
| | | | PHPBB3-11610
* [feature/passwords] Fix incorrect call to helper instead of $thisMarc Alexander2013-09-141-2/+2
| | | | | | | The driver helper method unique_id is called inside the helper. Therefore, it shouldn't be called via $this->helper but rather via $this. PHPBB3-11610
* [feature/passwords] Increase manager test coverage to cover all methodsMarc Alexander2013-09-141-2/+42
| | | | | | All methods in the manager are now fully covered. PHPBB3-11610
* [feature/passwords] Do not use specific errors but just return falseMarc Alexander2013-09-141-12/+13
| | | | | | | The authentication system should handle the possible errors for now. Additional error returns can be added later on if they are needed. PHPBB3-11610
* [feature/passwords] NULL should be null according to coding guidelinesMarc Alexander2013-09-141-1/+1
| | | | PHPBB3-11610
* [feature/passwords] Do not check if type_map is emptyMarc Alexander2013-09-141-11/+0
| | | | | | | | If the type map is empty the service container is incomplete or broken. There is no need to check this as other components would probably be broken at the same time. PHPBB3-11610
* [feature/passwords] Use randomly generated password for testsMarc Alexander2013-09-141-28/+36
| | | | | | | The password will start with 'foobar' and then continue with random characters that will be appended every iteration. PHPBB3-11610
* [feature/passwords] Fix tests on PHP versions < 5.3.7Marc Alexander2013-09-141-18/+38
| | | | PHPBB3-11610
* [feature/passwords] Properly treat duplicates in combined hashesMarc Alexander2013-09-142-1/+9
| | | | PHPBB3-11610
* [feature/passwords] Make method get_hashing_public_algorithm publicMarc Alexander2013-09-141-1/+1
| | | | | | | Combined hashing requires it for checking the supplied password hash for its hashing algorithm. PHPBB3-11610
* [feature/passwords] Add tests for combined hashing of passwordsMarc Alexander2013-09-141-2/+39
| | | | PHPBB3-11610
* [feature/passwords] Add combined hashing method to helperMarc Alexander2013-09-142-0/+40
| | | | | | | This will allow to hash a previously hashed password with another hashing method, i.e. as upgrade path from phpBB 3.0 to 3.1. PHPBB3-11610
* [feature/passwords] Add function for obtaining only the hash to helperMarc Alexander2013-09-141-0/+11
| | | | | | This is also needed for combined hashing of passwords. PHPBB3-11610
* [feature/passwords] Fix minor code limitations in helperMarc Alexander2013-09-141-2/+3
| | | | | | | These limitations caused it to only allow a specific input to combined hashes. PHPBB3-11610
* [feature/passwords] Pass phpbb_container to passwords helperMarc Alexander2013-09-142-2/+9
| | | | PHPBB3-11610
* [feature/passwords] Use correct prefix for salt in salted_md5Marc Alexander2013-09-141-1/+1
| | | | PHPBB3-11610
* [feature/passwords] Add method for obtaining the hash settings onlyMarc Alexander2013-09-143-0/+38
| | | | | | This is needed for combined hashing of passwords. PHPBB3-11610
* [feature/passwords] Add schema changes for new hash typesMarc Alexander2013-09-149-9/+72
| | | | PHPBB3-11610
* [feature/passwords] Make sure hash has the required lengthMarc Alexander2013-09-142-3/+17
| | | | | | | Also added tests to make sure that crypto drivers are enforcing the hash length. PHPBB3-11610
* [feature/passwords] Make method get_hashing_algorithm() protectedMarc Alexander2013-09-141-1/+1
| | | | | | There is currently no use for it being public. PHPBB3-11610
* [feature/passwords] Add tests for manager check_hash() methodMarc Alexander2013-09-141-0/+40
| | | | | | Tests cover all supported hashing algorithms. PHPBB3-11610
* [feature/passwords] Fix tests for PHP version < 5.3.7Marc Alexander2013-09-141-6/+18
| | | | PHPBB3-11610
* [feature/passwords] Use common salt generation function for all typesMarc Alexander2013-09-143-31/+47
| | | | | | | | We will be using the same method inside the driver helper class for all hash types. This is the same function that has been used for the salted md5 hash of phpBB 3.0. PHPBB3-11610
* [feature/passwords] Add driver helper class fileMarc Alexander2013-09-141-0/+108
| | | | PHPBB3-11610
* [feature/passwords] Include driver helper in manager_testMarc Alexander2013-09-141-0/+1
| | | | PHPBB3-11610
* [feature/passwords] Add driver helper class for additional functionsMarc Alexander2013-09-143-28/+9
| | | | | | | Functions for the helper class might be used in other drivers as well and therefore shouldn't be limited to just one driver. PHPBB3-11610
* [feature/passwords] Add basic passwords manager test fileMarc Alexander2013-09-141-0/+65
| | | | PHPBB3-11610
* [feature/passwords] Do not support 8-bit characters with $2a$ bcryptMarc Alexander2013-09-141-7/+13
| | | | | | | | 8-bit unicode characters might reduce the security of the password hash when using the $2a$ bcrypt prefix. Those types of characters are usually not used in passwords but we should prevent this possible issue anyway. PHPBB3-11610
* [feature/passwords] Add convert flag for converting to defaultMarc Alexander2013-09-141-7/+8
| | | | PHPBB3-11610
* [feature/passwords] Correctly supply hash salt and settings to bcryptMarc Alexander2013-09-141-3/+2
| | | | PHPBB3-11610
* [feature/passwords] Use correct prefix for bcrypt typeMarc Alexander2013-09-141-1/+1
| | | | PHPBB3-11610
* [feature/passwords] Default to bcrypt with $2y$ prefix if possibleMarc Alexander2013-09-141-1/+1
| | | | PHPBB3-11610
* [feature/passwords] Add basic bcrypt drivers for $2a$ & $2y$ prefixMarc Alexander2013-09-142-0/+135
| | | | | | | | The $2a$ prefix is the basic implementation with the $2y$ prefix extending that class. However, the default hashes for phpBB should be generated with $2y$ unless the PHP version is older than 5.3.7. PHPBB3-11610
* [feature/passwords] Add salted md5 (phpBB3 default) and phpass driversMarc Alexander2013-09-142-0/+226
| | | | | | | The phpass driver extends the standard salted md5 driver of phpBB3. It will only support the $P$ prefix that phpass uses. PHPBB3-11610
* [feature/passwords] Add crypto driver base class and interfaceMarc Alexander2013-09-142-0/+99
| | | | PHPBB3-11610
* [feature/passwords] Add helper functions, i.e. for combined hashesMarc Alexander2013-09-141-0/+140
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Combined hashes can be used for i.e. converting already existing password hashes to bcrypt. While this will not provide the same security a pure bcrypt hash provides, it will still be significantly more secure than a standard salted md5. A combined hash will look as follows: $H\2y${salted_for_H_prefix}${salt_+_settings_for_2y_prefix}${hash} The prefixes are seperated by a backslash. Individual settings (which can include either just the salt or a salt and possible additional settings) are seperated by dollar signs. As backslashes and dollar signs are not allowed in hashes or salts, they will be used for seperating the settings from the salt. Here is an example of a password hash: $H\2a$9zv1uIaq1$10\1ff4640409fb96a449c1fO$/oN1O0cdUmFSMZT3UZKrgAyalhnt1LC The 'H' prefix stands for the salted md5 implementation of phpBB 3.0. Its settings will be parsed as 9zv1uIaq1 resulting in a hash for the check as follows: $H$9zv1uIaq1{hash} Since the password is used for hashing, the {hash} can be left blank and will basically be filled by the hashing algorithm. The {hash} will then be used as password for the next hashing algorithm. In this case that would be the bcrypt algorithm. The settings are set to 10\1ff4640409fb96a449c1fO which will be transformed to 10$1ff4640409fb96a449c1fO resulting in a hash like this for the bcrypt hashing function: $2a$10$1ff4640409fb96a449c1fO{hash} The {hash} will again be basically filled by the hashing algorithm. Afterwards, the {hash} will be extracted from the returned hash and put at the end of the already known hash settings: $H\2a$9zv1uIaq1$10\1ff4640409fb96a449c1fO$ If the password is correct, the combined hash will of course be the same as the stored one. PHPBB3-11610
* [feature/passwords] Add service collection file crypto.ymlMarc Alexander2013-09-142-0/+36
| | | | | | | This will contain definitions of the services and the service collection that will be passed to the passwords manager. PHPBB3-11610
* [feature/passwords] Add basic implementation of passwords managerMarc Alexander2013-09-142-0/+207
| | | | | | | The passwords manager is capable of checking and hashing passwords. It will support different hashing algorithms. PHPBB3-11610
* Merge remote-tracking branch 'rechosen/ticket/11792' into developJoas Schilling2013-08-224-1/+127
|\ | | | | | | | | | | | | * rechosen/ticket/11792: [ticket/11792] Add functional test for var lang_set_ext of core.user_setup [ticket/11792] Add performance remark to core.user_setup event PHPDoc [ticket/11792] Add variable 'lang_set_ext' to event core.user_setup
| * [ticket/11792] Add functional test for var lang_set_ext of core.user_setuprechosen2013-08-223-0/+111
| | | | | | | | | | | | | | | | | | To ensure that the new lang_set_ext variable available with the core.user_setup event works properly, a functional test was added. It overwrites the value of the 'SKIP' language key, which is assumed to remain in use for some time to come. PHPBB3-11792
| * [ticket/11792] Add performance remark to core.user_setup event PHPDocrechosen2013-08-191-0/+3
| | | | | | | | | | | | | | | | To prevent extension authors from loading all their translations globally, a remark on this was added to the PHPDoc documentation of the core.user_setup event. PHPBB3-11792
| * [ticket/11792] Add variable 'lang_set_ext' to event core.user_setuprechosen2013-08-191-1/+13
| | | | | | | | | | | | | | | | | | To allow extensions to add global language strings just like mods can, add the 'lang_set_ext' variable to the core.user_setup event. It requires an ext_name to be specified as well as a lang_set, and loads the specified lang_set in the context of the extension. PHPBB3-11792
* | Merge remote-tracking branch 'mvinny/ticket/11804' into developAndreas Fischer2013-08-201-1/+0
|\ \ | | | | | | | | | | | | * mvinny/ticket/11804: [ticket/11804] Remove </li> from overall_header which was not open
generated by cgit v1.2.1 (git 2.21.0) at 2025-04-13 00:36:46 +0000