PasswordService.php

Go to the documentation of this file.

<?php
 
namespace Elgg;
 
use Elgg\Exceptions\RuntimeException;
 
final class PasswordService {
 
    public function __construct() {
        if (!function_exists('password_hash')) {
            throw new RuntimeException('password_hash and associated functions are required.');
        }
    }
 
    public function needsRehash(string $hash): bool {
        return password_needs_rehash($hash, PASSWORD_DEFAULT);
    }
 
    public function verify(string $password, string $hash): bool {
        return password_verify($password, $hash);
    }
 
    public function generateHash(string $password) {
        return password_hash($password, PASSWORD_DEFAULT);
    }
 
    public function requestNewPassword(\ElggUser $user): void {
        // generate code
        $user->passwd_conf_code = elgg_generate_password();
        $user->passwd_conf_time = time();
 
        $user->notify('requestnewpassword', $user, [
            'ip_address' => _elgg_services()->request->getClientIp(),
        ]);
    }
 
    public function saveNewPassword(\ElggUser $user, string $conf_code, ?string $password = null): bool {
        if ($password === null) {
            $password = elgg_generate_password();
            $reset = true;
        } else {
            $reset = false;
        }
 
        $saved_code = $user->passwd_conf_code;
        $code_time = (int) $user->passwd_conf_time;
        $codes_match = _elgg_services()->crypto->areEqual($saved_code, $conf_code);
 
        if (!$saved_code || !$codes_match) {
            return false;
        }
 
        // Discard for security if it is 24h old
        if (!$code_time || $code_time < time() - 24 * 60 * 60) {
            return false;
        }
 
        $user->setPassword($password);
        
        unset($user->passwd_conf_code);
        unset($user->passwd_conf_time);
        
        // reset the logins failures
        elgg_reset_authentication_failures($user);
 
        $user->notify($reset ? 'resetpassword' : 'changepassword', $user, [
            'password' => $password,
        ]);
 
        return true;
    }
}