/** * Php function for mysql old_password() * provides backward compatibility for zero board4 which uses old_password() of mysql 4.1 earlier versions. * the function implemented by referring to the source codes of password.c file in mysql * * @param string $password * @return string */ function mysql_pre4_hash_password($password) { return VendorPass::mysql_old_password($password); }
/** * Hash a password. * * To use multiple algorithms in series, provide them as an array. * Salted algorithms such as bcrypt, pbkdf2, or portable must be used last. * On error, false will be returned. * * @param string $password * @param string|array $algos (optional) * @param string $salt (optional) * @return string|false */ public static function hashPassword($password, $algos = null, $salt = null) { // If the algorithm is null, use the default algorithm. if ($algos === null) { $algos = self::getDefaultAlgorithm(); } // Initialize the chain of hashes. $algos = array_map('strtolower', array_map('trim', is_array($algos) ? $algos : explode(',', $algos))); $hashchain = preg_replace('/\\s+/', ' ', trim($password)); // Apply the given algorithms one by one. foreach ($algos as $algo) { switch ($algo) { // bcrypt (must be used last) case 'bcrypt': $hashchain = self::bcrypt($hashchain, $salt, self::getWorkFactor()); if ($hashchain[0] === '*') { return false; } return $hashchain; // PBKDF2 (must be used last) // PBKDF2 (must be used last) case 'pbkdf2': if ($salt === null) { $salt = Security::getRandom(12, 'alnum'); $hash_algorithm = 'sha512'; $iterations = intval(pow(2, self::getWorkFactor() + 5)) ?: 16384; $key_length = 24; } else { $parts = explode(':', $salt); $salt = $parts[2]; $hash_algorithm = $parts[0]; $iterations = intval($parts[1], 10); $key_length = strlen(base64_decode($parts[3])); } return self::pbkdf2($hashchain, $salt, $hash_algorithm, $iterations, $key_length); // phpass portable algorithm (must be used last) // phpass portable algorithm (must be used last) case 'portable': $phpass = new \Hautelook\Phpass\PasswordHash(self::getWorkFactor(), true); if ($salt === null) { $hashchain = $phpass->HashPassword($hashchain); return $hashchain; } else { $match = $phpass->CheckPassword($hashchain, $salt); return $match ? $salt : false; } // Drupal's SHA-512 based algorithm (must be used last) // Drupal's SHA-512 based algorithm (must be used last) case 'drupal': $hashchain = \VendorPass::drupal($password, $salt); return $hashchain; // Joomla's MD5 based algorithm (must be used last) // Joomla's MD5 based algorithm (must be used last) case 'joomla': $hashchain = \VendorPass::joomla($password, $salt); return $hashchain; // KimsQ Rb algorithms (must be used last) // KimsQ Rb algorithms (must be used last) case 'kimsqrb': $hashchain = \VendorPass::kimsqrb($password, $salt); return $hashchain; // crypt() function (must be used last) // crypt() function (must be used last) case 'crypt': if ($salt === null) { $salt = Security::getRandom(2, 'alnum'); } $hashchain = crypt($hashchain, $salt); return $hashchain; // MS SQL's PWDENCRYPT() function (must be used last) // MS SQL's PWDENCRYPT() function (must be used last) case 'mssql_pwdencrypt': $hashchain = \VendorPass::mssql_pwdencrypt($hashchain, $salt); return $hashchain; // MySQL's old PASSWORD() function. // MySQL's old PASSWORD() function. case 'mysql_old_password': $hashchain = \VendorPass::mysql_old_password($hashchain); break; // MySQL's new PASSWORD() function. // MySQL's new PASSWORD() function. case 'mysql_new_password': $hashchain = \VendorPass::mysql_new_password($hashchain); break; // A dummy algorithm that does nothing. // A dummy algorithm that does nothing. case 'null': break; // All other algorithms will be passed to hash() or treated as a function name. // All other algorithms will be passed to hash() or treated as a function name. default: if (isset(self::$_algorithm_callbacks[$algo])) { $callback = self::$_algorithm_callbacks[$algo]; $hashchain = $callback($hashchain, $salt); } elseif (in_array($algo, hash_algos())) { $hashchain = hash($algo, $hashchain); } elseif (function_exists($algo)) { $hashchain = $algo($hashchain, $salt); } else { return false; } } } return $hashchain; }