actually use the on-disk site-specific nonce to 'pepper' passwords before hashing...

diff --git a/authsystem.inc.php b/authsystem.inc.php
index a30e2abfbb23050137e307e64c698ee61b8fac7b..322e17faf74d615bed3c27f5d495b49fa6c58b9c 100644 (file)
--- a/authsystem.inc.php
+++ b/authsystem.inc.php
@@ -9,6 +9,8 @@ ini_set('display_errors', 1); error_reporting(E_ALL);
 // Read DB settings
 $dbdata = json_decode(file_get_contents('/etc/kairo/auth_db.json'), true);
 if (!is_array($dbdata)) { trigger_error('DB configuration not found', E_USER_ERROR); }
+$settings = json_decode(file_get_contents('/etc/kairo/auth_settings.json'), true);
+if (!is_array($settings)) { trigger_error('Auth settings not found', E_USER_ERROR); }
 
 // Extended DOM document class
 require_once('../kairo/include/cbsm/util/document.php-class');
@@ -16,7 +18,7 @@ require_once('../kairo/include/cbsm/util/document.php-class');
 require_once('../kairo/include/classes/email.php-class');
 // Class for sending emails
 require_once(__DIR__.'/authutils.php-class');
-$utils = new AuthUtils(array());
+$utils = new AuthUtils($settings);
 
 bindtextdomain('kairo_auth', 'en'); // XXX: Should negotiate locale.
 bind_textdomain_codeset('kairo_auth', 'utf-8');

diff --git a/authutils.php-class b/authutils.php-class
index 2d4573f5c76a9cc6dd21ac63c98fc3c90b741011..0b7d4b1e2acd4328e7ec0b25cc8160d119dae91e 100755 (executable)
--- a/authutils.php-class
+++ b/authutils.php-class
@@ -15,6 +15,7 @@ class AuthUtils {
   //
   // private $pwd_nonces
   //   The array of nonces to use for "peppering" passwords. For new hashes, the last one of those will be used.
+  //     Generate a nonce with this command: |openssl rand -base64 48|
   //
   // function checkPasswordConstraints($new_password, $user_email)
   //   Check password constraints and return an array of error messages (empty if all constraints are met).
@@ -119,10 +120,12 @@ class AuthUtils {
   }
 
   function pwdVerify($password_to_verify, $userdata) {
-    if (preg_match('/^(\d+)\|/', $userdata['pwdhash'], $regs)) {
+    $pwdhash = $userdata['pwdhash'];
+    if (preg_match('/^(\d+)\|(.+)$/', $userdata['pwdhash'], $regs)) {
       $password_to_verify .= $this->pwd_nonces[$regs[1]];
+      $pwdhash = $regs[2];
     }
-    return password_verify($password_to_verify, $userdata['pwdhash']);
+    return password_verify($password_to_verify, $pwdhash);
   }
 
   function pwdNeedsRehash($userdata) {