PasswordService.php

Go to the documentation of this file.

<?php

namespace Elgg;

use Elgg\Exceptions\RuntimeException;

final class PasswordService {

    public function __construct() {
        if (!function_exists('password_hash')) {
            throw new RuntimeException('password_hash and associated functions are required.');
        }
    }

    public function needsRehash(string $hash): bool {
        return password_needs_rehash($hash, PASSWORD_DEFAULT);
    }

    public function verify(string $password, string $hash): bool {
        return password_verify($password, $hash);
    }

    public function generateHash(string $password) {
        return password_hash($password, PASSWORD_DEFAULT);
    }

    public function requestNewPassword(\ElggUser $user): void {
        // generate code
        $code = elgg_generate_password();
        $user->passwd_conf_code = $code;
        $user->passwd_conf_time = time();

        // generate link
        $link = elgg_generate_url('account:password:change', [
            'u' => $user->guid,
            'c' => $code,
        ]);
        $link = _elgg_services()->urlSigner->sign($link, '+1 day');

        // generate email
        $ip_address = _elgg_services()->request->getClientIp();
        $message = _elgg_services()->translator->translate('email:changereq:body', [
            $ip_address,
            $link,
        ], $user->getLanguage());
        
        $subject = _elgg_services()->translator->translate('email:changereq:subject', [], $user->getLanguage());

        $params = [
            'action' => 'requestnewpassword',
            'object' => $user,
            'ip_address' => $ip_address,
            'link' => $link,
            'apply_muting' => false,
            'add_mute_link' => false,
        ];
        
        notify_user($user->guid, elgg_get_site_entity()->guid, $subject, $message, $params, 'email');
    }

    public function saveNewPassword(\ElggUser $user, string $conf_code, string $password = null): bool {
        if ($password === null) {
            $password = elgg_generate_password();
            $reset = true;
        } else {
            $reset = false;
        }

        $saved_code = $user->passwd_conf_code;
        $code_time = (int) $user->passwd_conf_time;
        $codes_match = _elgg_services()->crypto->areEqual($saved_code, $conf_code);

        if (!$saved_code || !$codes_match) {
            return false;
        }

        // Discard for security if it is 24h old
        if (!$code_time || $code_time < time() - 24 * 60 * 60) {
            return false;
        }

        $user->setPassword($password);
        
        unset($user->passwd_conf_code);
        unset($user->passwd_conf_time);
        
        // reset the logins failures
        elgg_reset_authentication_failures($user);

        $action = $reset ? 'resetpassword' : 'changepassword';

        $message = _elgg_services()->translator->translate("email:{$action}:body", [$user->username, $password], $user->getLanguage());
        $subject = _elgg_services()->translator->translate("email:{$action}:subject", [], $user->getLanguage());

        $params = [
            'action' => $action,
            'object' => $user,
            'password' => $password,
            'apply_muting' => false,
        ];

        notify_user($user->guid, elgg_get_site_entity()->guid, $subject, $message, $params, 'email');

        return true;
    }
}