PasswordHashFactory.php

Go to the documentation of this file.

<?php
declare(strict_types = 1);
namespace ‪TYPO3\CMS\Core\Crypto\PasswordHashing;
 
/*
 * This file is part of the TYPO3 CMS project.
 *
 * It is free software; you can redistribute it and/or modify it under
 * the terms of the GNU General Public License, either version 2
 * of the License, or any later version.
 *
 * For the full copyright and license information, please read the
 * LICENSE.txt file that was distributed with this source code.
 *
 * The TYPO3 project - inspiring people to share!
 */
 
use ‪TYPO3\CMS\Core\Utility\GeneralUtility;
 
class ‪PasswordHashFactory
{
    protected static ‪$instance;
 
    public function get(string $hash, string $mode): ‪PasswordHashInterface
    {
        if ($mode !== 'FE' && $mode !== 'BE') {
            throw new \InvalidArgumentException('Mode must be either \'FE\' or \'BE\', ' . $mode . ' given.', 1533948312);
        }
 
        $registeredHashClasses = static::getRegisteredSaltedHashingMethods();
 
        if (empty(‪$GLOBALS['TYPO3_CONF_VARS'][$mode]['passwordHashing']['className'])
            || !isset(‪$GLOBALS['TYPO3_CONF_VARS'][$mode]['passwordHashing']['options'])
            || !is_array(‪$GLOBALS['TYPO3_CONF_VARS'][$mode]['passwordHashing']['options'])
        ) {
            throw new \LogicException(
                'passwordHashing configuration of ' . $mode . ' broken',
                1533949053
            );
        }
        $defaultHashClassName = ‪$GLOBALS['TYPO3_CONF_VARS'][$mode]['passwordHashing']['className'];
        $defaultHashOptions = (array)‪$GLOBALS['TYPO3_CONF_VARS'][$mode]['passwordHashing']['options'];
 
        foreach ($registeredHashClasses as $className) {
            if ($className === $defaultHashClassName) {
                $hashInstance = GeneralUtility::makeInstance($className, $defaultHashOptions);
            } else {
                $hashInstance = GeneralUtility::makeInstance($className);
            }
            if (!$hashInstance instanceof ‪PasswordHashInterface) {
                throw new \LogicException('Class ' . $className . ' does not implement PasswordHashInterface', 1533818569);
            }
            if ($hashInstance->isAvailable() && $hashInstance->isValidSaltedPW($hash)) {
                return $hashInstance;
            }
        }
        // Do not add the hash to the exception to prevent information disclosure
        throw new ‪InvalidPasswordHashException(
            'No implementation found to handle given hash. This happens if the stored hash uses a'
            . ' mechanism not supported by current server. Follow the documentation link to fix this issue.',
            1533818591
        );
    }
 
    public function ‪getDefaultHashInstance(string $mode): ‪PasswordHashInterface
    {
        if ($mode !== 'FE' && $mode !== 'BE') {
            throw new \InvalidArgumentException('Mode must be either \'FE\' or \'BE\', ' . $mode . ' given.', 1533820041);
        }
 
        if (empty(‪$GLOBALS['TYPO3_CONF_VARS'][$mode]['passwordHashing']['className'])
            || !isset(‪$GLOBALS['TYPO3_CONF_VARS'][$mode]['passwordHashing']['options'])
            || !is_array(‪$GLOBALS['TYPO3_CONF_VARS'][$mode]['passwordHashing']['options'])
        ) {
            throw new \LogicException(
                'passwordHashing configuration of ' . $mode . ' broken',
                1533950622
            );
        }
 
        $defaultHashClassName = ‪$GLOBALS['TYPO3_CONF_VARS'][$mode]['passwordHashing']['className'];
        $defaultHashOptions = ‪$GLOBALS['TYPO3_CONF_VARS'][$mode]['passwordHashing']['options'];
        $availableHashClasses = static::getRegisteredSaltedHashingMethods();
 
        if (!in_array($defaultHashClassName, $availableHashClasses, true)) {
            throw new ‪InvalidPasswordHashException(
                'Configured default hash method ' . $defaultHashClassName . ' is not registered',
                1533820194
            );
        }
        $hashInstance =  GeneralUtility::makeInstance($defaultHashClassName, $defaultHashOptions);
        if (!$hashInstance instanceof ‪PasswordHashInterface) {
            throw new \LogicException(
                'Configured default hash method ' . $defaultHashClassName . ' is not an instance of PasswordHashInterface',
                1533820281
            );
        }
        if (!$hashInstance->isAvailable()) {
            throw new ‪InvalidPasswordHashException(
                'Configured default hash method ' . $defaultHashClassName . ' is not available. If'
                . ' the instance has just been upgraded, please log in to the standalone install tool'
                . ' at typo3/install.php to fix this. Follow the documentation link for more details.',
                1533822084
            );
        }
        return $hashInstance;
    }
 
    public static function ‪getRegisteredSaltedHashingMethods(): array
    {
        $saltMethods = ‪$GLOBALS['TYPO3_CONF_VARS']['SYS']['availablePasswordHashAlgorithms'];
        if (!is_array($saltMethods) || empty($saltMethods)) {
            throw new \RuntimeException('No password hash methods configured', 1533948733);
        }
        if (isset(‪$GLOBALS['TYPO3_CONF_VARS']['SC_OPTIONS']['ext/saltedpasswords']['saltMethods'])) {
            trigger_error(
                'Registering additional hash algorithms in $GLOBALS[\'TYPO3_CONF_VARS\'][\'SC_OPTIONS\'][\'ext/saltedpasswords\'][\'saltMethods\']'
                . ' has been deprecated. Extend $GLOBALS[\'TYPO3_CONF_VARS\'][\'SYS\'][\'availablePasswordHashAlgorithms\'] instead',
                E_USER_DEPRECATED
            );
            $configuredMethods = (array)‪$GLOBALS['TYPO3_CONF_VARS']['SC_OPTIONS']['ext/saltedpasswords']['saltMethods'];
            if (!empty($configuredMethods)) {
                $saltMethods = array_merge($saltMethods, $configuredMethods);
            }
        }
        return $saltMethods;
    }
 
    public static function ‪getSaltingInstance($saltedHash = '', $mode = TYPO3_MODE)
    {
        trigger_error(
            'This method is obsolete and will be removed in TYPO3 v10.0. Use get() and getDefaultHashInstance() instead.',
            E_USER_DEPRECATED
        );
        // Creating new instance when
        // * no instance existing
        // * a salted hash given to determine salted hashing method from
        // * a NULL parameter given to reset instance back to default method
        if (!is_object(self::$instance) || !empty($saltedHash) || $saltedHash === null) {
            // Determine method by checking the given hash
            if (!empty($saltedHash)) {
                $result = ‪self::determineSaltingHashingMethod($saltedHash, $mode);
                if (!$result) {
                    self::$instance = null;
                }
            } else {
                $classNameToUse = ‪SaltedPasswordsUtility::getDefaultSaltingHashingMethod($mode);
                self::$instance = GeneralUtility::makeInstance($classNameToUse);
            }
        }
        return ‪self::$instance;
    }
 
    public static function ‪determineSaltingHashingMethod(string $saltedHash, $mode = TYPO3_MODE): bool
    {
        trigger_error(
            'This method is obsolete and will be removed in TYPO3 v10.0.',
            E_USER_DEPRECATED
        );
        $registeredMethods = static::getRegisteredSaltedHashingMethods();
        $defaultClassName = ‪SaltedPasswordsUtility::getDefaultSaltingHashingMethod($mode);
        unset($registeredMethods[$defaultClassName]);
        // place the default method first in the order
        $registeredMethods = [$defaultClassName => $defaultClassName] + $registeredMethods;
        $methodFound = false;
        foreach ($registeredMethods as $method) {
            $objectInstance = GeneralUtility::makeInstance($method);
            if ($objectInstance instanceof ‪PasswordHashInterface && $objectInstance->‪isAvailable()) {
                $methodFound = $objectInstance->isValidSaltedPW($saltedHash);
                if ($methodFound) {
                    self::$instance = $objectInstance;
                    break;
                }
            }
        }
        return $methodFound;
    }
 
    public static function ‪setPreferredHashingMethod(string $resource)
    {
        trigger_error('This method is obsolete and will be removed in TYPO3 v10.0.', E_USER_DEPRECATED);
        self::$instance = null;
        $objectInstance = GeneralUtility::makeInstance($resource);
        if ($objectInstance instanceof ‪PasswordHashInterface) {
            self::$instance = $objectInstance;
        }
        return ‪self::$instance;
    }
}