Repository navigation
Conversation
…check Guard constant references with defined() checks so that systems without Argon2 support can safely fall back to bcrypt without fatal errors. Follow-up to nextcloud#64733 Fixes nextcloud#65780 Signed-off-by: User Name <user@example.com>
There was a problem hiding this comment.
The match (true) pattern is not verry readable, and also, I think this won't work as the message will contain a ref to an algo that is not used I think. Maybe best to revert to the old code logic.
There was a problem hiding this comment.
There was a problem hiding this comment.
My link is a diff, please check the left part of the link (4e0e711e247c08025433254c88e877244c7b854ee3746523b75e6598a8386808)
There was a problem hiding this comment.
@artonge Ah, the red one! My apologies!
#[\Override]
public function hash(string $message): string {
$alg = $this->getPrefferedAlgorithm();
if (\defined('PASSWORD_ARGON2ID') && $alg === PASSWORD_ARGON2ID) {
return 3 . '|' . password_hash($message, PASSWORD_ARGON2ID, $this->options);
}
if (\defined('PASSWORD_ARGON2I') && $alg === PASSWORD_ARGON2I) {
return 2 . '|' . password_hash($message, PASSWORD_ARGON2I, $this->options);
}
return 1 . '|' . password_hash($message, PASSWORD_BCRYPT, $this->options);
}
Hasher.php SHA-512 Hash: `fcc70008dd3bdd28be13c1e457954b34acefe6796e0cd63a774cb916e7d798caced1842e922bbae106421400686a5ab96612bc35fa8000add77488d1a839e0d2` Signed-off-by: hiro-gj <49264814+hiro-gj@users.noreply.github.com>
…1feb8 fix/Hasher-argon2_before_commit_ee1feb8
|
/backport to stable35 |
|
@hiro-gj can you fix the conflicts? |
…e line endings to LF Keep the legacy hash validation fix from c0525c3 while applying the defined() check for PASSWORD_ARGON2 constants in Hasher::hash(). Fixes nextcloud#65780 Signed-off-by: hiro-gj <49264814+hiro-gj@users.noreply.github.com> Signed-off-by: User Name <user@example.com>
@artonge Sorry! There was an issue with the line endings. https://github.com/nextcloud/server/pull/65791/changes Thanks! |
PASSWORD_ARGON2IDinOCSecurityHasher#65780Summary
Guard
PASSWORD_ARGON2IDandPASSWORD_ARGON2Iconstants withdefined()checks inHasher::hash().On PHP environments compiled without Argon2 support (
--with-password-argon2not enabled), referencing these undefined constants results in a fatal error (Error: Undefined constant "OC\Security\PASSWORD_ARGON2ID") before the bcrypt fallback can be evaluated.Follow-up to #64733
cc @provokateurin
Checklist