PasswordPolicyChecks.php

Go to the documentation of this file.

<?php
use \Cdb\Reader as CdbReader;
 
class PasswordPolicyChecks {
 
    public static function checkMinimalPasswordLength( $policyVal, User $user, $password ) {
        $status = Status::newGood();
        if ( $policyVal > strlen( $password ) ) {
            $status->error( 'passwordtooshort', $policyVal );
        }
        return $status;
    }
 
    public static function checkMinimumPasswordLengthToLogin( $policyVal, User $user, $password ) {
        $status = Status::newGood();
        if ( $policyVal > strlen( $password ) ) {
            $status->fatal( 'passwordtooshort', $policyVal );
        }
        return $status;
    }
 
    public static function checkMaximalPasswordLength( $policyVal, User $user, $password ) {
        $status = Status::newGood();
        if ( $policyVal < strlen( $password ) ) {
            $status->fatal( 'passwordtoolong', $policyVal );
        }
        return $status;
    }
 
    public static function checkPasswordCannotMatchUsername( $policyVal, User $user, $password ) {
        global $wgContLang;
        $status = Status::newGood();
        $username = $user->getName();
        if ( $policyVal && $wgContLang->lc( $password ) === $wgContLang->lc( $username ) ) {
            $status->error( 'password-name-match' );
        }
        return $status;
    }
 
    public static function checkPasswordCannotMatchBlacklist( $policyVal, User $user, $password ) {
        static $blockedLogins = [
            'Useruser' => 'Passpass', 'Useruser1' => 'Passpass1', # r75589
            'Apitestsysop' => 'testpass', 'Apitestuser' => 'testpass' # r75605
        ];
 
        $status = Status::newGood();
        $username = $user->getName();
        if ( $policyVal ) {
            if ( isset( $blockedLogins[$username] ) && $password == $blockedLogins[$username] ) {
                $status->error( 'password-login-forbidden' );
            }
 
            // Example from ApiChangeAuthenticationRequest
            if ( $password === 'ExamplePassword' ) {
                $status->error( 'password-login-forbidden' );
            }
        }
        return $status;
    }
 
    public static function checkPopularPasswordBlacklist( $policyVal, User $user, $password ) {
        global $wgPopularPasswordFile, $wgSitename;
        $status = Status::newGood();
        if ( $policyVal > 0 ) {
            $langEn = Language::factory( 'en' );
            $passwordKey = $langEn->lc( trim( $password ) );
 
            // People often use the name of the current site, which won't be
            // in the common password file. Also check '' for people who use
            // just whitespace.
            $sitename = $langEn->lc( trim( $wgSitename ) );
            $hardcodedCommonPasswords = [ '', 'wiki', 'mediawiki', $sitename ];
            if ( in_array( $passwordKey, $hardcodedCommonPasswords ) ) {
                $status->error( 'passwordtoopopular' );
                return $status;
            }
 
            // This could throw an exception, but there's not a good way
            // of failing gracefully, if say the file is missing, so just
            // let the exception fall through.
            // Format of cdb file is mapping password => popularity rank.
            // See maintenance/createCommonPasswordCdb.php
            $db = CdbReader::open( $wgPopularPasswordFile );
 
            $res = $db->get( $passwordKey );
            if ( $res && (int)$res <= $policyVal ) {
                // Note: If you want to find the true number of common
                // passwords stored (for reporting the error), you have to take
                // the max of the policyVal and $db->get( '_TOTALENTRIES' ).
                $status->error( 'passwordtoopopular' );
            }
        }
        return $status;
    }
 
}