Represents a password hash for use in authentication. More...
Public Member Functions | |
| __construct (PasswordFactory $factory, array $config, string $hash=null) | |
| Construct the Password object using a string hash. More... | |
| crypt (string $password) | |
| Hash a password and store the result in this object. More... | |
| getType () | |
| Get the type name of the password. More... | |
| needsUpdate () | |
| Determine if the hash needs to be updated. More... | |
| toString () | |
| Convert this hash to a string that can be stored in the database. More... | |
| verify (string $password) | |
| Checks whether the given password matches the hash stored in this object. More... | |
Protected Member Functions | |
| assertIsSafeSize (string $hash) | |
| Assert that hash will fit in a tinyblob field. More... | |
| isSupported () | |
| Whether current password type is supported on this system. More... | |
| parseHash (?string $hash) | |
| Perform any parsing necessary on the hash to see if the hash is valid and/or to perform logic for seeing if the hash needs updating. More... | |
Protected Attributes | |
| array | $config |
| Array of configuration variables injected from the constructor. More... | |
| PasswordFactory | $factory |
| Factory that created the object. More... | |
| string null | $hash |
| String representation of the hash without the type. More... | |
Detailed Description
Represents a password hash for use in authentication.
Note: All password types are transparently prefixed with :<TYPE>:, where <TYPE> is the registered type of the hash. This prefix is stripped in the constructor and is added back in the toString() function.
When inheriting this class, there are a couple of expectations to be fulfilled:
- If Password::toString() is called on an object, and the result is passed back in to PasswordFactory::newFromCiphertext(), the result will be identical to the original. With these two points in mind, when creating a new Password sub-class, there are some functions you have to override (because they are abstract) and others that you may want to override.
The abstract functions that must be overridden are:
- Password::crypt(), which takes a plaintext password and hashes it into a string hash suitable for being passed to the constructor of that class, and then stores that hash (and whatever other data) into the internal state of the object. The functions that can optionally be overridden are:
- Password::parseHash(), which can be useful to override if you need to extract values from or otherwise parse a password hash when it's passed to the constructor.
- Password::needsUpdate(), which can be useful if a specific password hash has different logic for when the hash needs to be updated.
- Password::toString(), which can be useful if the hash was changed in the constructor and needs to be re-assembled before being returned as a string. This function is expected to add the type back on to the hash, so make sure to do that if you override the function.
- Password::verify() - This function checks if $this->hash was generated with the given password. The default is to just hash the password and do a timing-safe string comparison with $this->hash.
After creating a new password hash type, it can be registered using the static Password::register() method. The default type is set using the Password::setDefaultType() type. Types must be registered before they can be set as the default.
- Since
- 1.24
Definition at line 61 of file Password.php.
Constructor & Destructor Documentation
◆ __construct()
|
final |
Construct the Password object using a string hash.
It is strongly recommended not to call this function directly unless you have a reason to. Use the PasswordFactory class instead.
- Exceptions
-
MWException If $config does not contain required parameters
- Parameters
-
PasswordFactory $factory Factory object that created the password array $config Array of engine configuration options for hashing string | null $hash The raw hash, including the type
Definition at line 96 of file Password.php.
References $config, $factory, $hash, isSupported(), and parseHash().
Member Function Documentation
◆ assertIsSafeSize()
|
finalprotected |
Assert that hash will fit in a tinyblob field.
This prevents MW from inserting it into the DB and having MySQL silently truncating it, locking the user out of their account.
- Parameters
-
string $hash The hash in question.
- Exceptions
-
PasswordError If hash does not fit in DB.
Definition at line 193 of file Password.php.
◆ crypt()
|
abstract |
Hash a password and store the result in this object.
The result of the password hash should be put into the internal state of the hash object.
- Parameters
-
string $password Password to hash
- Exceptions
-
PasswordError If an internal error occurs in hashing
Reimplemented in MWSaltedPassword, MWOldPassword, InvalidPassword, LayeredParameterizedPassword, EncryptedPassword, BcryptPassword, Argon2Password, and AbstractPbkdf2Password.
Referenced by LayeredParameterizedPassword\partialCrypt().
◆ getType()
|
final |
Get the type name of the password.
- Returns
- string Password type
Definition at line 120 of file Password.php.
◆ isSupported()
|
protected |
Whether current password type is supported on this system.
- Returns
- bool
Reimplemented in Pbkdf2PasswordUsingOpenSSL, and Argon2Password.
Definition at line 129 of file Password.php.
Referenced by __construct().
◆ needsUpdate()
|
abstract |
Determine if the hash needs to be updated.
- Returns
- bool True if needs update, false otherwise
Reimplemented in ParameterizedPassword, InvalidPassword, and Argon2Password.
◆ parseHash()
|
protected |
Perform any parsing necessary on the hash to see if the hash is valid and/or to perform logic for seeing if the hash needs updating.
- Parameters
-
string | null $hash The hash, with the :<TYPE>: prefix stripped
- Exceptions
-
PasswordError If there is an error in parsing the hash
Reimplemented in ParameterizedPassword, and BcryptPassword.
Definition at line 140 of file Password.php.
Referenced by __construct().
◆ toString()
| Password::toString | ( | ) |
Convert this hash to a string that can be stored in the database.
The resulting string should be considered the serialized representation of this hash, i.e., if the return value were recycled back into PasswordFactory::newFromCiphertext, the returned object would be equivalent to this; also, if two objects return the same value from this function, they are considered equivalent.
- Returns
- string
- Exceptions
-
PasswordError if password cannot be serialized to fit a tinyblob.
Reimplemented in ParameterizedPassword, InvalidPassword, and Argon2Password.
Definition at line 177 of file Password.php.
◆ verify()
| Password::verify | ( | string | $password | ) |
Checks whether the given password matches the hash stored in this object.
- Parameters
-
string $password Password to check
- Returns
- bool
Reimplemented in InvalidPassword, and Argon2Password.
Definition at line 156 of file Password.php.
Member Data Documentation
◆ $config
|
protected |
Array of configuration variables injected from the constructor.
Definition at line 77 of file Password.php.
Referenced by __construct(), and AbstractPbkdf2Password\newInstance().
◆ $factory
|
protected |
Factory that created the object.
Definition at line 65 of file Password.php.
Referenced by __construct(), and AbstractPbkdf2Password\newInstance().
◆ $hash
|
protected |
String representation of the hash without the type.
Definition at line 71 of file Password.php.
Referenced by __construct(), and AbstractPbkdf2Password\newInstance().
The documentation for this class was generated from the following file:
- includes/password/Password.php
