adulau/cakephp2-php8
1
0
Fork 0
mirror of https://github.com/kamilwylegala/cakephp2-php8.git synced 2024-11-15 03:18:26 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Hash passwords even when users don't exist.

Browse source 
Not hashing passwords when users don't exist means there is an
opportunity for timing attacks when people use blowfish or other
expensive hashing algorithms.
This commit is contained in:
mark_story 2013-07-01 21:51:17 -04:00
parent 2219991d3b
commit 17e4eee73d
2 changed files with 6 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
lib/Cake/Controller/Component/Auth/BaseAuthenticate.php
View file

@ -83,6 +83,9 @@ abstract class BaseAuthenticate {
* conditions for Model::find('first'). If the $password param is not provided
* the password field will be present in returned array.
*
* Input passwords will be hashed even when a user doesn't exist. This
* helps mitigate timing attacks that are attempting to find valid usernames.
*
* @param string|array $username The username/identifier, or an array of find conditions.
* @param string $password The password, only used if $username param is string.
* @return boolean|array Either false on failure, or an array of user data.
@ -95,9 +98,6 @@ abstract class BaseAuthenticate {
if (is_array($username)) {
$conditions = $username;
} else {
if (!$password) {
return false;
}
$conditions = array(
$model . '.' . $fields['username'] => $username
);
@ -113,6 +113,7 @@ abstract class BaseAuthenticate {
'contain' => $this->settings['contain'],
));
if (empty($result[$model])) {
$this->passwordHasher()->hash($password);
return false;
}

3
lib/Cake/Controller/Component/Auth/DigestAuthenticate.php
View file

@ -86,7 +86,8 @@ class DigestAuthenticate extends BasicAuthenticate {
'realm' => '',
'qop' => 'auth',
'nonce' => '',
'opaque' => ''
'opaque' => '',
'passwordHasher' => 'Simple',
);
/**