PasswordPolicyChecks.php

Go to the documentation of this file.

<?php
use Cdb\Reader as CdbReader;
use MediaWiki\MediaWikiServices;
use Wikimedia\PasswordBlacklist;
 
class PasswordPolicyChecks {
 
    public static function checkMinimalPasswordLength( $policyVal, User $user, $password ) {
        $status = Status::newGood();
        if ( $policyVal > strlen( $password ) ) {
            $status->error( 'passwordtooshort', $policyVal );
        }
        return $status;
    }
 
    public static function checkMinimumPasswordLengthToLogin( $policyVal, User $user, $password ) {
        $status = Status::newGood();
        if ( $policyVal > strlen( $password ) ) {
            $status->fatal( 'passwordtooshort', $policyVal );
        }
        return $status;
    }
 
    public static function checkMaximalPasswordLength( $policyVal, User $user, $password ) {
        $status = Status::newGood();
        if ( $policyVal < strlen( $password ) ) {
            $status->fatal( 'passwordtoolong', $policyVal );
        }
        return $status;
    }
 
    public static function checkPasswordCannotMatchUsername( $policyVal, User $user, $password ) {
        $status = Status::newGood();
        $username = $user->getName();
        $contLang = MediaWikiServices::getInstance()->getContentLanguage();
        if (
            $policyVal && hash_equals( $contLang->lc( $username ), $contLang->lc( $password ) )
        ) {
            $status->error( 'password-name-match' );
        }
        return $status;
    }
 
    public static function checkPasswordCannotMatchBlacklist( $policyVal, User $user, $password ) {
        static $blockedLogins = [
            'Useruser' => 'Passpass', 'Useruser1' => 'Passpass1', # r75589
            'Apitestsysop' => 'testpass', 'Apitestuser' => 'testpass' # r75605
        ];
 
        $status = Status::newGood();
        $username = $user->getName();
        if ( $policyVal ) {
            if (
                isset( $blockedLogins[$username] ) &&
                hash_equals( $blockedLogins[$username], $password )
            ) {
                $status->error( 'password-login-forbidden' );
            }
 
            // Example from ApiChangeAuthenticationRequest
            if ( hash_equals( 'ExamplePassword', $password ) ) {
                $status->error( 'password-login-forbidden' );
            }
        }
        return $status;
    }
 
    public static function checkPopularPasswordBlacklist( $policyVal, User $user, $password ) {
        global $wgPopularPasswordFile, $wgSitename;
        $status = Status::newGood();
        if ( $policyVal > 0 ) {
            $langEn = Language::factory( 'en' );
            $passwordKey = $langEn->lc( trim( $password ) );
 
            // People often use the name of the current site, which won't be
            // in the common password file. Also check '' for people who use
            // just whitespace.
            $sitename = $langEn->lc( trim( $wgSitename ) );
            $hardcodedCommonPasswords = [ '', 'wiki', 'mediawiki', $sitename ];
            if ( in_array( $passwordKey, $hardcodedCommonPasswords ) ) {
                $status->error( 'passwordtoopopular' );
                return $status;
            }
 
            // This could throw an exception, but there's not a good way
            // of failing gracefully, if say the file is missing, so just
            // let the exception fall through.
            // Format of cdb file is mapping password => popularity rank.
            // See maintenance/createCommonPasswordCdb.php
            $db = CdbReader::open( $wgPopularPasswordFile );
 
            $res = $db->get( $passwordKey );
            if ( $res && (int)$res <= $policyVal ) {
                // Note: If you want to find the true number of common
                // passwords stored (for reporting the error), you have to take
                // the max of the policyVal and $db->get( '_TOTALENTRIES' ).
                $status->error( 'passwordtoopopular' );
            }
        }
        return $status;
    }
 
    public static function checkPasswordNotInLargeBlacklist( $policyVal, User $user, $password ) {
        $status = Status::newGood();
        if ( $policyVal && PasswordBlacklist\PasswordBlacklist::isBlacklisted( $password ) ) {
            $status->error( 'passwordinlargeblacklist' );
        }
 
        return $status;
    }
 
}