PasswordService.php

Go to the documentation of this file.

<?php

namespace Elgg;

final class PasswordService {

    public function __construct() {
        if (!function_exists('password_hash')) {
            throw new \RuntimeException("password_hash and associated functions are required.");
        }
    }

    public function needsRehash($hash) {
        return password_needs_rehash($hash, PASSWORD_DEFAULT);
    }

    public function verify($password, $hash) {
        return password_verify($password, $hash);
    }

    public function generateHash($password) {
        return password_hash($password, PASSWORD_DEFAULT);
    }

    public function sendNewPasswordRequest($user_guid) {
        $user_guid = (int) $user_guid;

        $user = _elgg_services()->entityTable->get($user_guid);
        if (!$user instanceof \ElggUser) {
            return false;
        }

        // generate code
        $code = generate_random_cleartext_password();
        $user->setPrivateSetting('passwd_conf_code', $code);
        $user->setPrivateSetting('passwd_conf_time', time());

        // generate link
        $link = elgg_generate_url('account:password:change', [
            'u' => $user_guid,
            'c' => $code,
        ]);
        $link = _elgg_services()->urlSigner->sign($link, '+1 day');

        // generate email
        $ip_address = _elgg_services()->request->getClientIp();
        $message = _elgg_services()->translator->translate('email:changereq:body', [
            $user->name,
            $ip_address,
            $link,
        ], $user->language);
        $subject = _elgg_services()->translator->translate('email:changereq:subject', [], $user->language);

        $params = [
            'action' => 'requestnewpassword',
            'object' => $user,
            'ip_address' => $ip_address,
            'link' => $link,
        ];
        
        return notify_user($user->guid, elgg_get_site_entity()->guid, $subject, $message, $params, 'email');
    }

    public function forcePasswordReset($user, $password) {
        if (!$user instanceof \ElggUser) {
            $user = _elgg_services()->entityTable->get($user, 'user');
            if (!$user instanceof \ElggUser) {
                return false;
            }
        }

        $user->setPassword($password);

        $ia = _elgg_services()->session->setIgnoreAccess(true);
        $result = (bool) $user->save();
        _elgg_services()->session->setIgnoreAccess($ia);

        return $result;
    }

    public function executeNewPasswordReset($user_guid, $conf_code, $password = null) {
        $user_guid = (int) $user_guid;
        $user = get_entity($user_guid);

        if ($password === null) {
            $password = generate_random_cleartext_password();
            $reset = true;
        } else {
            $reset = false;
        }

        if (!$user instanceof \ElggUser) {
            return false;
        }

        $saved_code = $user->getPrivateSetting('passwd_conf_code');
        $code_time = (int) $user->getPrivateSetting('passwd_conf_time');
        $codes_match = _elgg_services()->crypto->areEqual($saved_code, $conf_code);

        if (!$saved_code || !$codes_match) {
            return false;
        }

        // Discard for security if it is 24h old
        if (!$code_time || $code_time < time() - 24 * 60 * 60) {
            return false;
        }

        if (!$this->forcePasswordReset($user, $password)) {
            return false;
        }

        $user->removePrivateSetting('passwd_conf_code');
        $user->removePrivateSetting('passwd_conf_time');
        
        // clean the logins failures
        reset_login_failure_count($user_guid);

        $ns = $reset ? 'resetpassword' : 'changepassword';

        $message = _elgg_services()->translator->translate(
            "email:$ns:body", [$user->username, $password], $user->language);
        $subject = _elgg_services()->translator->translate("email:$ns:subject", [], $user->language);

        $params = [
            'action' => $ns,
            'object' => $user,
            'password' => $password,
        ];

        notify_user($user->guid, elgg_get_site_entity()->guid, $subject, $message, $params, 'email');

        return true;
    }
}