d_s_bisht/devsofttech_hms_ci4
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Handle legacy null password hashes safely in session login

Browse Source
This commit is contained in:
DevSoftTech Server 2026-03-05 14:08:30 +05:30
parent 90692a84c6
commit 47ec1ee54a
2 changed files with 67 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

65
app/Authentication/Authenticators/LegacySafeSession.php Normal file
View File

@ -0,0 +1,65 @@
<?php
declare(strict_types=1);
namespace App\Authentication\Authenticators;
use CodeIgniter\Shield\Authentication\Authenticators\Session;
use CodeIgniter\Shield\Authentication\Passwords;
use CodeIgniter\Shield\Result;
class LegacySafeSession extends Session
{
/**
* @phpstan-param array{email?: string, username?: string, password?: string} $credentials
*/
public function check(array $credentials): Result
{
if (empty($credentials['password']) || count($credentials) < 2) {
return new Result([
'success' => false,
'reason' => lang('Auth.badAttempt'),
]);
}
$givenPassword = (string) $credentials['password'];
unset($credentials['password']);
$user = $this->provider->findByCredentials($credentials);
if ($user === null) {
return new Result([
'success' => false,
'reason' => lang('Auth.badAttempt'),
]);
}
$hash = $user->password_hash ?? null;
if (!is_string($hash) || trim($hash) === '') {
return new Result([
'success' => false,
'reason' => lang('Auth.invalidPassword'),
]);
}
/** @var Passwords $passwords */
$passwords = service('passwords');
if (!$passwords->verify($givenPassword, $hash)) {
return new Result([
'success' => false,
'reason' => lang('Auth.invalidPassword'),
]);
}
if ($passwords->needsRehash($hash)) {
$user->password_hash = $passwords->hash($givenPassword);
$this->provider->save($user);
}
return new Result([
'success' => true,
'extraInfo' => $user,
]);
}
}

4
app/Config/Auth.php
View File

@ -13,13 +13,13 @@ declare(strict_types=1);
namespace Config;
use App\Authentication\Authenticators\LegacySafeSession;
use CodeIgniter\Shield\Config\Auth as ShieldAuth;
use CodeIgniter\Shield\Authentication\Actions\ActionInterface;
use CodeIgniter\Shield\Authentication\AuthenticatorInterface;
use CodeIgniter\Shield\Authentication\Authenticators\AccessTokens;
use CodeIgniter\Shield\Authentication\Authenticators\HmacSha256;
use CodeIgniter\Shield\Authentication\Authenticators\JWT;
use CodeIgniter\Shield\Authentication\Authenticators\Session;
use CodeIgniter\Shield\Authentication\Passwords\CompositionValidator;
use CodeIgniter\Shield\Authentication\Passwords\DictionaryValidator;
use CodeIgniter\Shield\Authentication\Passwords\NothingPersonalValidator;
@ -120,7 +120,7 @@ class Auth extends ShieldAuth
*/
public array $authenticators = [
'tokens' => AccessTokens::class,
'session' => Session::class,
'session' => LegacySafeSession::class,
'hmac' => HmacSha256::class,
// 'jwt' => JWT::class,
];