tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Hash the password for an unknown username at login.

Browse Source 
An unknown username got a fast answer, which showed which usernames exist.
This commit is contained in:
tim
2026-09-26 15:27:51 +02:00
parent c8030b759d
commit 061f9c1a37
3 changed files with 42 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/php/Unit/PasswordTest.php
+24
View File
@@ -23,6 +23,30 @@ class PasswordTest extends TestCase {
$this->assertSame(defined('PASSWORD_ARGON2ID') ? PASSWORD_ARGON2ID : PASSWORD_BCRYPT, password_algorithm());
}
public function testEditorPasswordValid(): void {
$hash = password_hash('secret', password_algorithm());
$this->assertTrue(editor_password_valid('secret', $hash));
$this->assertFalse(editor_password_valid('wrong', $hash));
$this->assertFalse(editor_password_valid('', ''));
$this->assertFalse(editor_password_valid('secret', NULL));
$this->assertFalse(editor_password_valid('', NULL));
}
// A fast answer for an unknown username would show which usernames exist
public function testAnUnknownEditorTakesAsLongAsAWrongPassword(): void {
$hash = password_hash('secret', password_algorithm());
$time = function ($stored) {
$best = INF;
for ($i = 0; $i < 3; $i++) {
$start = hrtime(TRUE);
editor_password_valid('wrong', $stored);
$best = min($best, hrtime(TRUE) - $start);
}
return $best;
};
$this->assertGreaterThan($time($hash) / 2, $time(NULL));
}
public function testHashIsStoredAndChecked(): void {
$this->addEditor('old');
$hash = password_hash('secret', password_algorithm());