PasswordPolicyChecks.php

Go to the documentation of this file.

<?php
use MediaWiki\MediaWikiServices;
use Wikimedia\CommonPasswords\CommonPasswords;
 
class PasswordPolicyChecks {
 
    public static function checkMinimalPasswordLength( $policyVal, User $user, $password ) {
        $status = Status::newGood();
        if ( $policyVal > strlen( $password ) ) {
            $status->error( 'passwordtooshort', $policyVal );
        }
        return $status;
    }
 
    public static function checkMinimumPasswordLengthToLogin( $policyVal, User $user, $password ) {
        $status = Status::newGood();
        if ( $policyVal > strlen( $password ) ) {
            $status->fatal( 'passwordtooshort', $policyVal );
        }
        return $status;
    }
 
    public static function checkMaximalPasswordLength( $policyVal, User $user, $password ) {
        $status = Status::newGood();
        if ( $policyVal < strlen( $password ) ) {
            $status->fatal( 'passwordtoolong', $policyVal );
        }
        return $status;
    }
 
    public static function checkPasswordCannotMatchUsername( $policyVal, User $user, $password ) {
        $status = Status::newGood();
        $username = $user->getName();
        $contLang = MediaWikiServices::getInstance()->getContentLanguage();
        if (
            $policyVal && hash_equals( $contLang->lc( $username ), $contLang->lc( $password ) )
        ) {
            $status->error( 'password-name-match' );
        }
        return $status;
    }
 
    public static function checkPasswordCannotBeSubstringInUsername(
        $policyVal,
        User $user,
        $password
    ) {
        $status = Status::newGood();
        $username = $user->getName();
        if ( $policyVal && stripos( $username, $password ) !== false ) {
            $status->error( 'password-substring-username-match' );
        }
        return $status;
    }
 
    public static function checkPasswordCannotMatchDefaults( $policyVal, User $user, $password ) {
        static $blockedLogins = [
            // r75589
            'Useruser' => 'Passpass',
            'Useruser1' => 'Passpass1',
            // r75605
            'Apitestsysop' => 'testpass',
            'Apitestuser' => 'testpass',
        ];
 
        $status = Status::newGood();
        $username = $user->getName();
        if ( $policyVal ) {
            if (
                isset( $blockedLogins[$username] ) &&
                hash_equals( $blockedLogins[$username], $password )
            ) {
                $status->error( 'password-login-forbidden' );
            }
 
            // Example from ApiChangeAuthenticationRequest
            if ( hash_equals( 'ExamplePassword', $password ) ) {
                $status->error( 'password-login-forbidden' );
            }
        }
        return $status;
    }
 
    public static function checkPasswordNotInCommonList( $policyVal, User $user, $password ) {
        $status = Status::newGood();
        if ( $policyVal && CommonPasswords::isCommon( $password ) ) {
            $status->error( 'passwordincommonlist' );
        }
 
        return $status;
    }
 
}