Drupal
/
drupal
mirror of https://git.drupalcode.org/project/drupal.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Issue #3277003 by mcdruid, catch, poker10, smustgrave, BramDriesen, guedressel, DamienMcKenna, xjm, Heine, greggles, fjgarlin, pwolanin, moshe weitzman: Harden user_pass_rehash() against attack

merge-requests/6081/head
catch 2024-01-09 10:27:15 +00:00
parent f1d04f612f
commit 0d27339305
2 changed files with 49 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

46
core/modules/user/tests/src/Kernel/UserPassRehashTest.php Normal file
View File

@ -0,0 +1,46 @@
<?php
namespace Drupal\Tests\user\Kernel;
use Drupal\KernelTests\KernelTestBase;
use Drupal\Tests\user\Traits\UserCreationTrait;
/**
* Tests user_pass_rehash().
*
* @group user
*/
class UserPassRehashTest extends KernelTestBase {
use UserCreationTrait;
/**
* {@inheritdoc}
*/
protected static $modules = [
'user',
];
/**
* Tests uniqueness of hashes when no password is set.
*/
public function testUniqueHashNoPasswordValue(): void {
$this->installEntitySchema('user');
$timestamp = \Drupal::time()->getRequestTime();
$user_a = $this->createUser([], NULL, FALSE, ['uid' => 12, 'mail' => '3user@example.com', 'login' => $timestamp - 1000]);
$user_b = $this->createUser([], NULL, FALSE, ['uid' => 123, 'mail' => 'user@example.com', 'login' => $timestamp - 1000]);
// Unset passwords after the users are created in order to avoid
// (different) password hashes being generated for the empty strings.
$user_a->setPassword('');
$user_b->setPassword('');
$hash_a = user_pass_rehash($user_a, $timestamp);
$hash_b = user_pass_rehash($user_b, $timestamp);
$this->assertNotEquals($hash_a, $hash_b);
}
}

6
core/modules/user/user.module
View File

@ -580,9 +580,9 @@ function user_cancel_url(UserInterface $account, $options = []) {
*/
function user_pass_rehash(UserInterface $account, $timestamp) {
$data = $timestamp;
$data .= $account->getLastLoginTime();
$data .= $account->id();
$data .= $account->getEmail();
$data .= ':' . $account->getLastLoginTime();
$data .= ':' . $account->id();
$data .= ':' . $account->getEmail();
return Crypt::hmacBase64($data, Settings::getHashSalt() . $account->getPassword());
}