C:/drupal/includes/password.inc

Go to the documentation of this file.

<?php
// $Id: password.inc,v 1.3 2008/05/26 17:12:54 dries Exp $

define('DRUPAL_HASH_COUNT', 14);

define('DRUPAL_MIN_HASH_COUNT', 7);

define('DRUPAL_MAX_HASH_COUNT', 30);

function _password_itoa64() {
  return './0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz';
}

function _password_base64_encode($input, $count)  {
  $output = '';
  $i = 0;
  $itoa64 = _password_itoa64();
  do {
    $value = ord($input[$i++]);
    $output .= $itoa64[$value & 0x3f];
    if ($i < $count) {
      $value |= ord($input[$i]) << 8;
    }
    $output .= $itoa64[($value >> 6) & 0x3f];
    if ($i++ >= $count) {
      break;
    }
    if ($i < $count) {
      $value |= ord($input[$i]) << 16;
    }
    $output .= $itoa64[($value >> 12) & 0x3f];
    if ($i++ >= $count) {
      break;
    }
    $output .= $itoa64[($value >> 18) & 0x3f];
  } while ($i < $count);

  return $output;
}

function _password_generate_salt($count_log2) {
  $output = '$P$';
  // Minimum log2 iterations is DRUPAL_MIN_HASH_COUNT.
  $count_log2 = max($count_log2, DRUPAL_MIN_HASH_COUNT);
  // Maximum log2 iterations is DRUPAL_MAX_HASH_COUNT.
  // We encode the final log2 iteration count in base 64.
  $itoa64 = _password_itoa64();
  $output .= $itoa64[min($count_log2, DRUPAL_MAX_HASH_COUNT)];
  // 6 bytes is the standard salt for a portable phpass hash.
  $output .= _password_base64_encode(drupal_random_bytes(6), 6);
  return $output;
}

function _password_crypt($password, $setting)  {
  // The first 12 characters of an existing hash are its setting string.
  $setting = substr($setting, 0, 12);

  if (substr($setting, 0, 3) != '$P$') {
    return FALSE;
  }
  $count_log2 = _password_get_count_log2($setting);
  // Hashes may be imported from elsewhere, so we allow != DRUPAL_HASH_COUNT
  if ($count_log2 < DRUPAL_MIN_HASH_COUNT || $count_log2 > DRUPAL_MAX_HASH_COUNT) {
    return FALSE;
  }
  $salt = substr($setting, 4, 8);
  // Hashes must have an 8 character salt.
  if (strlen($salt) != 8) {
    return FALSE;
  }

  // We must use md5() or sha1() here since they are the only cryptographic
  // primitives always available in PHP 5. To implement our own low-level
  // cryptographic function in PHP would result in much worse performance and
  // consequently in lower iteration counts and hashes that are quicker to crack
  // (by non-PHP code).

  $count = 1 << $count_log2;

  $hash = md5($salt . $password, TRUE);
  do {
    $hash = md5($hash . $password, TRUE);
  } while (--$count);

  $output =  $setting . _password_base64_encode($hash, 16);
  // _password_base64_encode() of a 16 byte MD5 will always be 22 characters.
  return (strlen($output) == 34) ? $output : FALSE;
}

function _password_get_count_log2($setting) {
  $itoa64 = _password_itoa64();
  return strpos($itoa64, $setting[3]);
}

function user_hash_password($password, $count_log2 = 0) {
  if (empty($count_log2)) {
    // Use the standard iteration count.
    $count_log2 = variable_get('password_count_log2', DRUPAL_HASH_COUNT);
  }
  return _password_crypt($password, _password_generate_salt($count_log2));
}

function user_check_password($password, $account) {
  if (substr($account->pass, 0, 3) == 'U$P') {
    // This may be an updated password from user_update_7000(). Such hashes
    // have 'U' added as the first character and need an extra md5().
    $stored_hash = substr($account->pass, 1);
    $password = md5($password);
  }
  else {
    $stored_hash = $account->pass;
  }
  $hash = _password_crypt($password, $stored_hash);
  return ($hash && $stored_hash == $hash);
}

function user_needs_new_hash($account) {
  // Check whether this was an updated password.
  if ((substr($account->pass, 0, 3) != '$P$') || (strlen($account->pass) != 34)) {
    return TRUE;
  }
  // Check whether the iteration count used differs from the standard number.
  return (_password_get_count_log2($account->pass) != variable_get('password_count_log2', DRUPAL_HASH_COUNT));
}

---