L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-71160 auth_db: Use strict comaprison

Browse Source 
Use strict comparison to avoid type juggling.

Signed-off-by: Sujith Haridasan <[email protected]>
This commit is contained in:
Sujith Haridasan
2021-09-07 00:14:39 +02:00
committed by Jenkins
parent e2b3d5fec5
commit 4ffc17be15
2 changed files with 19 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
auth/db/auth.php
+3 -3
View File
@@ -131,11 +131,11 @@ class auth_plugin_db extends auth_plugin_base {
$authdb->Close();
if ($this->config->passtype === 'plaintext') {
return ($fromdb == $extpassword);
return ($fromdb === $extpassword);
} else if ($this->config->passtype === 'md5') {
return (strtolower($fromdb) == md5($extpassword));
return (strtolower($fromdb) === md5($extpassword));
} else if ($this->config->passtype === 'sha1') {
return (strtolower($fromdb) == sha1($extpassword));
return (strtolower($fromdb) === sha1($extpassword));
} else if ($this->config->passtype === 'saltedcrypt') {
return password_verify($extpassword, $fromdb);
} else {
auth/db/tests/db_test.php
+16
View File
@@ -335,12 +335,28 @@ class auth_db_testcase extends advanced_testcase {
$DB->update_record('auth_db_users', $user3);
$this->assertTrue($auth->user_login('u3', 'heslo'));
// Test user created to see if the checking happens strictly.
$usermd5 = (object)['name' => 'usermd5', 'pass' => '0e462097431906509019562988736854'];
$usermd5->id = $DB->insert_record('auth_db_users', $usermd5);
// md5('240610708') === '0e462097431906509019562988736854'.
$this->assertTrue($auth->user_login('usermd5', '240610708'));
$this->assertFalse($auth->user_login('usermd5', 'QNKCDZO'));
set_config('passtype', 'sh1', 'auth_db');
$auth->config->passtype = 'sha1';
$user3->pass = sha1('heslo');
$DB->update_record('auth_db_users', $user3);
$this->assertTrue($auth->user_login('u3', 'heslo'));
// Test user created to see if the checking happens strictly.
$usersha1 = (object)['name' => 'usersha1', 'pass' => '0e66507019969427134894567494305185566735'];
$usersha1->id = $DB->insert_record('auth_db_users', $usersha1);
// sha1('aaroZmOk') === '0e66507019969427134894567494305185566735'.
$this->assertTrue($auth->user_login('usersha1', 'aaroZmOk'));
$this->assertFalse($auth->user_login('usersha1', 'aaK1STfY'));
set_config('passtype', 'saltedcrypt', 'auth_db');
$auth->config->passtype = 'saltedcrypt';
$user3->pass = password_hash('heslo', PASSWORD_BCRYPT);