MediaWiki  master
PasswordPolicyChecks.php
Go to the documentation of this file.
1 <?php
23 use Cdb\Reader as CdbReader;
26 
39 
47  public static function checkMinimalPasswordLength( $policyVal, User $user, $password ) {
48  $status = Status::newGood();
49  if ( $policyVal > strlen( $password ) ) {
50  $status->error( 'passwordtooshort', $policyVal );
51  }
52  return $status;
53  }
54 
64  public static function checkMinimumPasswordLengthToLogin( $policyVal, User $user, $password ) {
65  $status = Status::newGood();
66  if ( $policyVal > strlen( $password ) ) {
67  $status->fatal( 'passwordtooshort', $policyVal );
68  }
69  return $status;
70  }
71 
80  public static function checkMaximalPasswordLength( $policyVal, User $user, $password ) {
81  $status = Status::newGood();
82  if ( $policyVal < strlen( $password ) ) {
83  $status->fatal( 'passwordtoolong', $policyVal );
84  }
85  return $status;
86  }
87 
95  public static function checkPasswordCannotMatchUsername( $policyVal, User $user, $password ) {
96  $status = Status::newGood();
97  $username = $user->getName();
98  $contLang = MediaWikiServices::getInstance()->getContentLanguage();
99  if (
100  $policyVal && hash_equals( $contLang->lc( $username ), $contLang->lc( $password ) )
101  ) {
102  $status->error( 'password-name-match' );
103  }
104  return $status;
105  }
106 
114  public static function checkPasswordCannotMatchBlacklist( $policyVal, User $user, $password ) {
115  static $blockedLogins = [
116  'Useruser' => 'Passpass', 'Useruser1' => 'Passpass1', # r75589
117  'Apitestsysop' => 'testpass', 'Apitestuser' => 'testpass' # r75605
118  ];
119 
120  $status = Status::newGood();
121  $username = $user->getName();
122  if ( $policyVal ) {
123  if (
124  isset( $blockedLogins[$username] ) &&
125  hash_equals( $blockedLogins[$username], $password )
126  ) {
127  $status->error( 'password-login-forbidden' );
128  }
129 
130  // Example from ApiChangeAuthenticationRequest
131  if ( hash_equals( 'ExamplePassword', $password ) ) {
132  $status->error( 'password-login-forbidden' );
133  }
134  }
135  return $status;
136  }
137 
152  public static function checkPopularPasswordBlacklist( $policyVal, User $user, $password ) {
154  $status = Status::newGood();
155  if ( $policyVal > 0 ) {
156  $langEn = Language::factory( 'en' );
157  $passwordKey = $langEn->lc( trim( $password ) );
158 
159  // People often use the name of the current site, which won't be
160  // in the common password file. Also check '' for people who use
161  // just whitespace.
162  $sitename = $langEn->lc( trim( $wgSitename ) );
163  $hardcodedCommonPasswords = [ '', 'wiki', 'mediawiki', $sitename ];
164  if ( in_array( $passwordKey, $hardcodedCommonPasswords ) ) {
165  $status->error( 'passwordtoopopular' );
166  return $status;
167  }
168 
169  // This could throw an exception, but there's not a good way
170  // of failing gracefully, if say the file is missing, so just
171  // let the exception fall through.
172  // Format of cdb file is mapping password => popularity rank.
173  // See maintenance/createCommonPasswordCdb.php
174  $db = CdbReader::open( $wgPopularPasswordFile );
175 
176  $res = $db->get( $passwordKey );
177  if ( $res && (int)$res <= $policyVal ) {
178  // Note: If you want to find the true number of common
179  // passwords stored (for reporting the error), you have to take
180  // the max of the policyVal and $db->get( '_TOTALENTRIES' ).
181  $status->error( 'passwordtoopopular' );
182  }
183  }
184  return $status;
185  }
186 
201  public static function checkPasswordNotInLargeBlacklist( $policyVal, User $user, $password ) {
202  $status = Status::newGood();
203  if ( $policyVal && PasswordBlacklist\PasswordBlacklist::isBlacklisted( $password ) ) {
204  $status->error( 'passwordinlargeblacklist' );
205  }
206 
207  return $status;
208  }
209 
210 }
$wgSitename
Name of the site.
string $wgPopularPasswordFile
Where popular password file is located.
static checkPasswordCannotMatchBlacklist( $policyVal, User $user, $password)
Check if username and password are on a blacklist of past MediaWiki default passwords.
static checkMinimalPasswordLength( $policyVal, User $user, $password)
Check password is longer than minimum, not fatal.
getName()
Get the user name, or the IP of an anonymous user.
Definition: User.php:2229
The User object encapsulates all of the user-specific settings (user_id, name, rights, email address, options, last login time).
Definition: User.php:51
Functions to check passwords against a policy requirement.
static checkPasswordCannotMatchUsername( $policyVal, User $user, $password)
Check if username and password are a (case-insensitive) match.
static newGood( $value=null)
Factory function for good results.
Definition: StatusValue.php:81
static checkPasswordNotInLargeBlacklist( $policyVal, User $user, $password)
Ensure the password isn&#39;t in the list of passwords blacklisted by the wikimedia/password-blacklist li...
static factory( $code)
Get a cached or new language object for a given language code.
Definition: Language.php:212
static checkMinimumPasswordLengthToLogin( $policyVal, User $user, $password)
Check password is longer than minimum, fatal.
static checkPopularPasswordBlacklist( $policyVal, User $user, $password)
Ensure that password isn&#39;t in top X most popular passwords, as defined by $wgPopularPasswordFile.
static checkMaximalPasswordLength( $policyVal, User $user, $password)
Check password is shorter than maximum, fatal.