diff --git a/classes/security/Password.class.php b/classes/security/Password.class.php index 0cbeb59b3..ce4572063 100644 --- a/classes/security/Password.class.php +++ b/classes/security/Password.class.php @@ -132,22 +132,25 @@ class Password */ public function checkPassword($password, $hash, $algorithm = null) { - $password = trim($password); - if($algorithm === null) { $algorithm = $this->checkAlgorithm($hash); } - if(!array_key_exists($algorithm, $this->getSupportedAlgorithms())) - { - return false; - } + + $password = trim($password); switch($algorithm) { case 'md5': return md5($password) === $hash || md5(sha1(md5($password))) === $hash; + case 'mysql_old_password': + return (class_exists('Context') && substr(Context::getDBType(), 0, 5) === 'mysql') ? + DB::getInstance()->isValidOldPassword($password, $hash) : false; + + case 'mysql_password': + return $hash[0] === '*' && substr($hash, 1) === strtoupper(sha1(sha1($password, true))); + case 'pbkdf2': $hash = explode(':', $hash); $hash[3] = base64_decode($hash[3]); @@ -182,6 +185,14 @@ class Password { return 'md5'; } + elseif(strlen($hash) === 16 && ctype_xdigit($hash)) + { + return 'mysql_old_password'; + } + elseif(strlen($hash) === 41 && $hash[0] === '*') + { + return 'mysql_password'; + } else { return false;