?
avatar PhilETaylor
PhilETaylor
24 May 2021

Code review.

Support for Argon2id passwords using PASSWORD_ARGON2ID was added in PHP 7.3.0 and Joomla 4 needs to ensure full compatibility as low as /checks notes/ PHP 7.2.5

Documentation: https://www.php.net/manual/en/function.password-hash.php

using the constant PASSWORD_ARGON2ID therefore cannot be done.

return password_needs_rehash($hash, PASSWORD_ARGON2I);

avatar PhilETaylor PhilETaylor - open - 24 May 2021
avatar joomla-cms-bot joomla-cms-bot - change - 24 May 2021
Labels Added: ?
avatar joomla-cms-bot joomla-cms-bot - labeled - 24 May 2021
avatar PhilETaylor PhilETaylor - change - 24 May 2021
The description was changed
avatar PhilETaylor PhilETaylor - edited - 24 May 2021
avatar ReLater
ReLater - comment - 24 May 2021

I'm a bit irritated. You reference to joomla-cms/libraries/src/Authentication/Password/Argon2iHandler.php
PASSWORD_ARGON2ID is not used there. It uses PASSWORD_ARGON2I which is supported since 7.2.0

avatar PhilETaylor
PhilETaylor - comment - 24 May 2021

I'm a bit irritated.

Oh. Im sorry. I'm really really sorry that I made a typo and my irritated eyes did not notice the difference between PASSWORD_ARGON2I and PASSWORD_ARGON2ID

Let me go and search for the term for you...

Here is the correct file link reference:

return password_needs_rehash($hash, PASSWORD_ARGON2ID);

and here is what phpStorm states about it:

Screenshot 2021-05-24 at 13 14 03

avatar PhilETaylor
PhilETaylor - comment - 24 May 2021

This class is referenced by the password.handler.argon2id service in the container provided by:

$container->alias('password.handler.argon2id', Argon2idHandler::class)

avatar PhilETaylor
PhilETaylor - comment - 24 May 2021

Im guessing its a won't fix - as this code probably never runs, as the Argon2idHandler::isSupported checks the version number and returns false anyway... It would only get ran if someone used the password.handler.argon2id service directly.

avatar PhilETaylor PhilETaylor - change - 24 May 2021
Status New Closed
Closed_Date 0000-00-00 00:00:00 2021-05-24 12:20:38
Closed_By PhilETaylor
avatar PhilETaylor PhilETaylor - close - 24 May 2021

Add a Comment

Login with GitHub to post a comment