PasswordService.php

Go to the documentation of this file.

<?php
namespace Elgg;

final class PasswordService {

    public function __construct() {
        if (!function_exists('password_hash')) {
            throw new \RuntimeException("password_hash and associated functions are required.");
        }
    }

    function needsRehash($hash) {
        return password_needs_rehash($hash, PASSWORD_DEFAULT);
    }

    function verify($password, $hash) {
        return password_verify($password, $hash);
    }

    function generateHash($password) {
        return password_hash($password, PASSWORD_DEFAULT);
    }

    function generateLegacyHash(\ElggUser $user, $password) {
        return md5($password . $user->salt);
    }

    function sendNewPasswordRequest($user_guid) {
        $user_guid = (int)$user_guid;

        $user = _elgg_services()->entityTable->get($user_guid);
        if (!$user instanceof \ElggUser) {
            return false;
        }

        // generate code
        $code = generate_random_cleartext_password();
        $user->setPrivateSetting('passwd_conf_code', $code);
        $user->setPrivateSetting('passwd_conf_time', time());

        // generate link
        $link = _elgg_services()->config->getSiteUrl() . "changepassword?u=$user_guid&c=$code";
        $link = _elgg_services()->urlSigner->sign($link, '+1 day');
        
        // generate email
        $ip_address = _elgg_services()->request->getClientIp();
        $message = _elgg_services()->translator->translate(
            'email:changereq:body', array($user->name, $ip_address, $link), $user->language);
        $subject = _elgg_services()->translator->translate(
            'email:changereq:subject', array(), $user->language);

        $params = [
            'action' => 'requestnewpassword',
            'object' => $user,
            'ip_address' => $ip_address,
            'link' => $link,
        ];
        
        return notify_user($user->guid, elgg_get_site_entity()->guid, $subject, $message, $params, 'email');
    }

    function forcePasswordReset($user, $password) {
        if (!$user instanceof \ElggUser) {
            $user = _elgg_services()->entityTable->get($user, 'user');
            if (!$user) {
                return false;
            }
        }

        $user->setPassword($password);

        $ia = elgg_set_ignore_access(true);
        $result = (bool)$user->save();
        elgg_set_ignore_access($ia);

        return $result;
    }

    function executeNewPasswordReset($user_guid, $conf_code, $password = null) {
        $user_guid = (int)$user_guid;
        $user = get_entity($user_guid);

        if ($password === null) {
            $password = generate_random_cleartext_password();
            $reset = true;
        } else {
            $reset = false;
        }

        if (!$user instanceof \ElggUser) {
            return false;
        }

        $saved_code = $user->getPrivateSetting('passwd_conf_code');
        $code_time = (int) $user->getPrivateSetting('passwd_conf_time');
        $codes_match = _elgg_services()->crypto->areEqual($saved_code, $conf_code);

        if (!$saved_code || !$codes_match) {
            return false;
        }

        // Discard for security if it is 24h old
        if (!$code_time || $code_time < time() - 24 * 60 * 60) {
            return false;
        }

        if (!$this->forcePasswordReset($user, $password)) {
            return false;
        }

        remove_private_setting($user_guid, 'passwd_conf_code');
        remove_private_setting($user_guid, 'passwd_conf_time');
        // clean the logins failures
        reset_login_failure_count($user_guid);

        $ns = $reset ? 'resetpassword' : 'changepassword';

        $message = _elgg_services()->translator->translate(
            "email:$ns:body", array($user->username, $password), $user->language);
        $subject = _elgg_services()->translator->translate("email:$ns:subject", array(), $user->language);

        $params = [
            'action' => $ns,
            'object' => $user,
            'password' => $password,
        ];

        notify_user($user->guid, elgg_get_site_entity()->guid, $subject, $message, $params, 'email');

        return true;
    }
}