X-Git-Url: https://git-public.kairo.at/?p=authserver.git;a=blobdiff_plain;f=authutils.php-class;h=729a2e900ab087d7447295ab5bda628e790e4588;hp=6686f7bd5676984571b6b773050921e43c8ab793;hb=558e9862bdf09a65cb41c76569cdb3f4021fa356;hpb=d46a42f1c9fcf2191b42f9df10ae6dd876e6f10b

diff --git a/authutils.php-class b/authutils.php-class
index 6686f7b..729a2e9 100755
--- a/authutils.php-class
+++ b/authutils.php-class
@@ -7,25 +7,74 @@ class AuthUtils {
   // KaiRo.at authentication utilities PHP class
   // This class contains helper functions for the authentication system.
   //
-  // static function checkPasswordConstraints($new_password, $user_email)
+  // function __construct($settings, $db)
+  //   CONSTRUCTOR
+  //   Settings are an associative array with a numeric pwd_cost field and an array pwd_nonces field.
+  //   The DB is a PDO object.
+  //
+  // public $db
+  //   A PDO database object for interaction.
+  //
+  // private $pwd_cost
+  //   The cost parameter for use with PHP password_hash function.
+  //
+  // private $pwd_nonces
+  //   The array of nonces to use for "peppering" passwords. For new hashes, the last one of those will be used.
+  //     Generate a nonce with this command: |openssl rand -base64 48|
+  //
+  // function log($code, $additional_info)
+  //   Log an entry for admin purposes, with a code and some additional info.
+  //
+  // function checkPasswordConstraints($new_password, $user_email)
   //   Check password constraints and return an array of error messages (empty if all constraints are met).
   //
-  // static function createSessionKey()
+  // function createSessionKey()
   //   Return a random session key.
   //
-  // static function createVerificationCode()
+  // function createVerificationCode()
   //   Return a random acount/email verification code.
   //
-  // static function createTimeCode($session, [$offset], [$validity_minutes])
+  // function createTimeCode($session, [$offset], [$validity_minutes])
   //   Return a time-based code based on the key and ID of the given session.
   //     An offset can be given to create a specific code for verification, otherwise and offset will be generated.
   //     Also, an amount of minutes for the code to stay valid can be handed over, by default 10 minutes will be used.
   //
-  // static function verifyTimeCode($timecode_to_verify, $session, [$validity_minutes])
+  // function verifyTimeCode($timecode_to_verify, $session, [$validity_minutes])
   //   Verify a given time-based code and return true if it's valid or false if it's not.
   //     See createTimeCode() documentation for the session and validity paramerters.
+  //
+  // function pwdHash($new_password)
+  //   Return a hash for the given password.
+  //
+  // function pwdVerify($password_to_verify, $user)
+  //   Return true if the password verifies against the pwdhash field of the user, false if not.
+  //
+  // function pwdNeedsRehash($user)
+  //   Return true if the pwdhash field of the user uses an outdated standard and needs to be rehashed.
 
-  static function checkPasswordConstraints($new_password, $user_email) {
+  function __construct($settings, $db) {
+    // *** constructor ***
+    $this->db = $db;
+    if (array_key_exists('pwd_cost', $settings)) {
+      $this->pwd_cost = $settings['pwd_cost'];
+    }
+    if (array_key_exists('pwd_nonces', $settings)) {
+      $this->pwd_nonces = $settings['pwd_nonces'];
+    }
+  }
+
+  public $db = null;
+  private $pwd_cost = 10;
+  private $pwd_nonces = array();
+
+  function log($code, $info) {
+    $result = $this->db->prepare('INSERT INTO `auth_log` (`code`, `info`, `ip_addr`) VALUES (:code, :info, :ipaddr);');
+    if (!$result->execute(array(':code' => $code, ':info' => $info, ':ipaddr' => $_SERVER['REMOTE_ADDR']))) {
+      // print($result->errorInfo()[2]);
+    }
+  }
+
+  function checkPasswordConstraints($new_password, $user_email) {
     $errors = array();
     if ($new_password != trim($new_password)) {
       $errors[] = _('Password must not start or end with a whitespace character like a space.');
@@ -48,15 +97,15 @@ class AuthUtils {
     return $errors;
   }
 
-  static function createSessionKey() {
+  function createSessionKey() {
     return bin2hex(openssl_random_pseudo_bytes(512 / 8)); // Get 512 bits of randomness (128 byte hex string).
   }
 
-  static function createVerificationCode() {
+  function createVerificationCode() {
     return bin2hex(openssl_random_pseudo_bytes(512 / 8)); // Get 512 bits of randomness (128 byte hex string).
   }
 
-  static function createTimeCode($session, $offset = null, $validity_minutes = 10) {
+  function createTimeCode($session, $offset = null, $validity_minutes = 10) {
     // Matches TOTP algorithms, see https://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm
     $valid_seconds = intval($validity_minutes) * 60;
     if ($valid_seconds < 60) { $valid_seconds = 60; }
@@ -71,11 +120,44 @@ class AuthUtils {
     return $rest.'.'.$totp_value;
   }
 
-  static function verifyTimeCode($timecode_to_verify, $session, $validity_minutes = 10) {
+  function verifyTimeCode($timecode_to_verify, $session, $validity_minutes = 10) {
     if (preg_match('/^(\d+)\.\d+$/', $timecode_to_verify, $regs)) {
-      return ($timecode_to_verify === AuthUtils::createTimeCode($session, $regs[1], $validity_minutes));
+      return ($timecode_to_verify === $this->createTimeCode($session, $regs[1], $validity_minutes));
     }
     return false;
   }
+
+  function pwdHash($new_password) {
+    $hash_prefix = '';
+    if (count($this->pwd_nonces)) {
+      $new_password .= $this->pwd_nonces[count($this->pwd_nonces) - 1];
+      $hash_prefix = (count($this->pwd_nonces) - 1).'|';
+    }
+    return $hash_prefix.password_hash($new_password, PASSWORD_DEFAULT, array('cost' => $this->pwd_cost));
+  }
+
+  function pwdVerify($password_to_verify, $userdata) {
+    $pwdhash = $userdata['pwdhash'];
+    if (preg_match('/^(\d+)\|(.+)$/', $userdata['pwdhash'], $regs)) {
+      $password_to_verify .= $this->pwd_nonces[$regs[1]];
+      $pwdhash = $regs[2];
+    }
+    return password_verify($password_to_verify, $pwdhash);
+  }
+
+  function pwdNeedsRehash($userdata) {
+    $nonceid = -1;
+    $pwdhash = $userdata['pwdhash'];
+    if (preg_match('/^(\d+)\|(.+)$/', $userdata['pwdhash'], $regs)) {
+      $nonceid = $regs[1];
+      $pwdhash = $regs[2];
+    }
+    if ($nonceid == count($this->pwd_nonces) - 1) {
+      return password_needs_rehash($pwdhash, PASSWORD_DEFAULT, array('cost' => $this->pwd_cost));
+    }
+    else {
+      return true;
+    }
+  }
 }
 ?>