revi-archive/phorge-phorge
1
0
Fork 0
mirror of https://we.phorge.it/source/phorge.git synced 2025-01-28 23:48:19 +01:00
Code Issues Releases Wiki Activity

Provide more storage space for password hashes and migrate existing hashes to "md5:"

Browse source 
Summary: Ref T4443. Provide more space; remove the hack-glue.

Test Plan: Logged out, logged in, inspected database.

Reviewers: btrahan

Reviewed By: btrahan

CC: aran

Maniphest Tasks: T4443

Differential Revision: https://secure.phabricator.com/D8269
This commit is contained in:
epriestley 2014-02-18 10:12:47 -08:00
parent 3c9153079f
commit 5778627e41
3 changed files with 11 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
resources/sql/autopatches/20140218.passwords.1.extend.sql Normal file
View file

@ -0,0 +1,4 @@
/* Extend from 32 characters to 128. */
ALTER TABLE {$NAMESPACE}_user.user
CHANGE passwordHash passwordHash VARCHAR(128) COLLATE utf8_bin;

5
resources/sql/autopatches/20140218.passwords.2.prefix.sql Normal file
View file

@ -0,0 +1,5 @@
/* Mark all existing password hashes as "Iterated MD5". */
UPDATE {$NAMESPACE}_user.user
SET passwordHash = CONCAT('md5:', passwordHash)
WHERE LENGTH(passwordHash) > 0;

14
src/applications/people/storage/PhabricatorUser.php
View file

@ -173,8 +173,7 @@ final class PhabricatorUser
return PhabricatorPasswordHasher::comparePassword(
$this->getPasswordHashInput($envelope),
// TODO: For now, we need to add a prefix.
new PhutilOpaqueEnvelope('md5:'.$this->getPasswordHash()));
new PhutilOpaqueEnvelope($this->getPasswordHash()));
}
private function getPasswordHashInput(PhutilOpaqueEnvelope $password) {
@ -188,19 +187,10 @@ final class PhabricatorUser
}
private function hashPassword(PhutilOpaqueEnvelope $password) {
$hasher = PhabricatorPasswordHasher::getBestHasher();
$input_envelope = $this->getPasswordHashInput($password);
$output_envelope = $hasher->getPasswordHashForStorage($input_envelope);
// TODO: For now, we need to strip the type prefix until we can upgrade
// the storage.
$raw_output = $output_envelope->openEnvelope();
$raw_output = substr($raw_output, strlen('md5:'));
return new PhutilOpaqueEnvelope($raw_output);
return $hasher->getPasswordHashForStorage($input_envelope);
}
const CSRF_CYCLE_FREQUENCY = 3600;