Vanilla password security

squirrel · September 2008

Yeah, that would work. I'm not crazy about Authenticator creating its own UserManager object. Now there's an extra copy of UserManager that just hangs around all the time. I guess it doesn't matter because UM doesn't have any internal state but it feels clunky. I just can't think of any better way that doesn't change the signature of Authenticate(). It looks like this would do the job.

Dinoboff · September 2008

checking and creating the hash is the responsibility of the Authenticator (of Authenticator::PasswordHash). UserManager::HashPassword() and UserManager::CheckPassword() are just used if Authenticator hasn't been updated. And I also removed Authenticator::UserManager like you suggested: http://dl-client.getdropbox.com/u/83967/new-hash-no-trouble.diff

elm · October 2008

Is there a way to keep the md5-Hashes and still use md5? Because I set up a linuxserver on witch the user can authenticate against the vanilla-database and as far as I can see non of the 3 new password hash functions is available on linux especially on pam-mysql (http://pam-mysql.sourceforge.net/) witch cannot handle salts.

Dinoboff · October 2008

Try that: http://dl-client.getdropbox.com/u/83967/Md5authenticator-0.1.1.zip Read the readme.txt for instruction if you have any trouble with installing/un-installing it

Dinoboff · October 2008

Here are the details:


// extensions/Md5authenticator/default.php
<?php
/*
Extension Name: Md5Authenticator
Extension Url: http://lussumo.com/community/?CommentID=90404
Description: Replace Vanilla Authenticator to only use md5 hash
Version: 0.1.1
Author: Damien Lebrun
Author Url: N/A
*/

global $Context;

// Check for Vanilla 1.1.5 and that we didn't already installed our authenticator
if (array_key_exists('AUTHENTICATION_CLASS', $Context->Configuration)
	&& $Context->Configuration['AUTHENTICATION_MODULE'] !== 'Md5Autehnticator'
) {
	AddConfigurationSetting($Context,
			'AUTHENTICATION_MODULE', '../extensions/Md5authenticator/Authenticator.php');
	AddConfigurationSetting($Context,
			'AUTHENTICATION_CLASS', 'Md5Authenticator');
}

// extensions/Md5authenticator/Authenticator.php
<?php

if (!defined('IN_VANILLA')) exit();

global $Configuration;

include_once $Configuration['LIBRARY_PATH'] . '/People/People.Class.Authenticator.php';

class Md5Authenticator extends Authenticator {
	function Md5Authenticator(&$Context) {
		$this->Context = &$Context;
		$this->PasswordHash = new Md5Hash($Context);
	}
}

class Md5Hash {
	var $Context;

	function CheckPassword($User, $Password, $RegenerateHash=1) {
		if ($Password && $User->Password !== '*') {
			if (md5($Password) === $User->Password) {
				return true;
			} else if ($Password === $User->Password ) {
				if ($RegenerateHash) {
					$this->SetNewPassword($User, $Password);
				}
				return true;
			}
		}
		return false;
	}

	function HashPassword($Password) {
		return md5($Password);
	}

	function Md5Hash(&$Context) {
		$this->Context =& $Context;
	}


	function SetNewPassword($User, $Password) {
		$UserManager = $this->Context->ObjectFactory->NewContextObject(
			$this->Context, 'UserManager');
		$User->Password = $this->HashPassword($Password);
		return $UserManager->SaveUserCredentials($User);
	}
}

elm · October 2008

And what if 1.1.5 is already installed? I just enabled the extension but it does not seem to work. The passwords are still converted to the new format. //EDIT the code u posted here is not the code in the archive. i'll give the code you posted a try //EDIT Ok It works now. Thank you.

Dinoboff · October 2008

Sorry, I mixed the version I wrote and the one I debugged. I updated the post. Her is the archive: http://dl-client.getdropbox.com/u/83967/Md5authenticator-0.1.1.zip If you already upgraded to 1.1.5 I need to do a little change to support this case...

Dinoboff · October 2008

Here is a version that will work if you have already upgraded to 1.1.5: http://dl-client.getdropbox.com/u/83967/Md5authenticator-0.1.2.zip

elm · October 2008

Very nice. Thank you.

Vanilla password security

Comments