PasswordPolicyChecks.php

Go to the documentation of this file.

<?php
declare( strict_types = 1 );
 
namespace MediaWiki\Password;
 
use MediaWiki\Status\Status;
use MediaWiki\User\UserIdentity;
use Wikimedia\CommonPasswords\CommonPasswords;
 
class PasswordPolicyChecks {
 
    public static function checkMinimalPasswordLength( int $policyVal, UserIdentity $user, string $password ): Status {
        $status = Status::newGood();
        if ( $policyVal > strlen( $password ) ) {
            $status->error( 'passwordtooshort', $policyVal );
        }
        return $status;
    }
 
    public static function checkMinimumPasswordLengthToLogin(
        int $policyVal,
        UserIdentity $user,
        string $password
    ): Status {
        $status = Status::newGood();
        if ( $policyVal > strlen( $password ) ) {
            $status->fatal( 'passwordtooshort', $policyVal );
        }
        return $status;
    }
 
    public static function checkMaximalPasswordLength(
        int $policyVal,
        UserIdentity $user,
        string $password
    ): Status {
        $status = Status::newGood();
        if ( $policyVal < strlen( $password ) ) {
            $status->fatal( 'passwordtoolong', $policyVal );
        }
        return $status;
    }
 
    public static function checkPasswordCannotBeSubstringInUsername(
        bool $policyVal,
        UserIdentity $user,
        string $password
    ): Status {
        $status = Status::newGood();
        $username = $user->getName();
        if ( $policyVal && stripos( $username, $password ) !== false ) {
            $status->error( 'password-substring-username-match' );
        }
        return $status;
    }
 
    public static function checkPasswordCannotMatchDefaults(
        bool $policyVal,
        UserIdentity $user,
        string $password
    ): Status {
        static $blockedLogins = [
            // r75589
            'Useruser' => 'Passpass',
            'Useruser1' => 'Passpass1',
            // r75605
            'Apitestsysop' => 'testpass',
            'Apitestuser' => 'testpass',
        ];
 
        $status = Status::newGood();
        $username = $user->getName();
        if ( $policyVal ) {
            if (
                isset( $blockedLogins[$username] ) &&
                hash_equals( $blockedLogins[$username], $password )
            ) {
                $status->error( 'password-login-forbidden' );
            }
 
            // Example from ApiChangeAuthenticationRequest
            if ( hash_equals( 'ExamplePassword', $password ) ) {
                $status->error( 'password-login-forbidden' );
            }
        }
        return $status;
    }
 
    public static function checkPasswordNotInCommonList(
        bool $policyVal,
        UserIdentity $user,
        string $password
    ): Status {
        $status = Status::newGood();
        if ( $policyVal && CommonPasswords::isCommon( $password ) ) {
            $status->error( 'passwordincommonlist' );
        }
 
        return $status;
    }
 
}