adulau/cakephp2-php8
1
0
Fork 0
mirror of https://github.com/kamilwylegala/cakephp2-php8.git synced 2024-11-15 03:18:26 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Randomly generate a salt when the salt is '' or null.

Browse source 
To prevent an issue where any value is accepted as a password when '' is
provided as the hashed password.

Refs #8650
This commit is contained in:
mark_story 2016-04-15 21:49:17 -04:00
parent c6d5bfb2b9
commit 8b5023282e
2 changed files with 22 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

22
lib/Cake/Test/Case/Utility/SecurityTest.php
View file

@ -151,16 +151,36 @@ class SecurityTest extends CakeTestCase {
Security::setHash($_hashType); Security::setHash($_hashType);
} }
/**
* Test that blowfish doesn't return '' when the salt is ''
*
* @return void
*/
public function testHashBlowfishEmptySalt() {
$test = Security::hash('password', 'blowfish');
$this->skipIf(strpos($test, '$2a$') === false, 'Blowfish hashes are incorrect.');
$stored = '';
$hash = Security::hash('anything', 'blowfish', $stored);
$this->assertNotEquals($stored, $hash);
$hash = Security::hash('anything', 'blowfish', false);
$this->assertNotEquals($stored, $hash);
$hash = Security::hash('anything', 'blowfish', null);
$this->assertNotEquals($stored, $hash);
}
/** /**
* Test that hash() works with blowfish. * Test that hash() works with blowfish.
* *
* @return void * @return void
*/ */
public function testHashBlowfish() { public function testHashBlowfish() {
Security::setCost(10);
$test = Security::hash('password', 'blowfish'); $test = Security::hash('password', 'blowfish');
$this->skipIf(strpos($test, '$2a$') === false, 'Blowfish hashes are incorrect.'); $this->skipIf(strpos($test, '$2a$') === false, 'Blowfish hashes are incorrect.');
Security::setCost(10);
$_hashType = Security::$hashType; $_hashType = Security::$hashType;
$key = 'someKey'; $key = 'someKey';

2
lib/Cake/Utility/Security.php
View file

@ -303,7 +303,7 @@ class Security {
* @return string The hashed string or an empty string on error. * @return string The hashed string or an empty string on error.
*/ */
protected static function _crypt($password, $salt = false) { protected static function _crypt($password, $salt = false) {
if ($salt === false) { if ($salt === false || $salt === null || $salt === '') {
$salt = static::_salt(22); $salt = static::_salt(22);
$salt = vsprintf('$2a$%02d$%s', array(static::$hashCost, $salt)); $salt = vsprintf('$2a$%02d$%s', array(static::$hashCost, $salt));
} }