Thijs/wiki.techinc.nl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Drop wgPasswordSalt, deprecated since 1.24

Browse source 
Depends-On: Ic9952a1bd8563f218c3c581d4b206ebd6c6c9c44
Change-Id: I8b1d43aba62859645221caf5ff340903e4d61787
This commit is contained in:
James D. Forrester 2019-07-12 16:44:38 -07:00
parent e745bfed82
commit 2e909bcb5f
4 changed files with 3 additions and 20 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
RELEASE-NOTES-1.34
View file

@ -70,6 +70,8 @@ For notes on 1.33.x and older releases, see HISTORY.
* $wgDebugPrintHttpHeaders - The default of including HTTP headers in the
debug log channel is no longer configurable. The debug log itself remains
configurable via $wgDebugLogFile.
* $wgPasswordSalt – This setting, used for migrating exceptionally old, insecure
password setups and deprecated since 1.24, is now removed.
=== New user-facing features in 1.34 ===
* Special:Mute has been added as a quick way for users to block unwanted emails

6
includes/DefaultSettings.php
View file

@ -4710,12 +4710,6 @@ $wgRemoveCredentialsBlacklist = [
\MediaWiki\Auth\PasswordAuthenticationRequest::class,
];
/**
* For compatibility with old installations set to false
* @deprecated since 1.24 will be removed in future
*/
$wgPasswordSalt = true;
/**
* Specifies the minimal length of a user password. If set to 0, empty pass-
* words are allowed.

6
includes/auth/LocalPasswordPrimaryAuthenticationProvider.php
View file

@ -113,11 +113,7 @@ class LocalPasswordPrimaryAuthenticationProvider
// Check for *really* old password hashes that don't even have a type
// The old hash format was just an md5 hex hash, with no type information
if ( preg_match( '/^[0-9a-f]{32}$/', $row->user_password ) ) {
if ( $this->config->get( 'PasswordSalt' ) ) {
$row->user_password = ":B:{$row->user_id}:{$row->user_password}";
} else {
$row->user_password = ":A:{$row->user_password}";
}
$row->user_password = ":B:{$row->user_id}:{$row->user_password}";
}
$status = $this->checkPasswordValidity( $username, $req->password );

9
tests/phpunit/includes/auth/LocalPasswordPrimaryAuthenticationProviderTest.php
View file

@ -336,15 +336,6 @@ class LocalPasswordPrimaryAuthenticationProviderTest extends \MediaWikiTestCase
);
// Correct handling of really old password hashes
$this->config->set( 'PasswordSalt', false );
$password = md5( 'FooBar' );
$dbw->update( 'user', [ 'user_password' => $password ], [ 'user_name' => $userName ] );
$req->password = 'FooBar';
$this->assertEquals(
AuthenticationResponse::newPass( $userName ),
$provider->beginPrimaryAuthentication( $reqs )
);
$this->config->set( 'PasswordSalt', true );
$password = md5( "$id-" . md5( 'FooBar' ) );
$dbw->update( 'user', [ 'user_password' => $password ], [ 'user_name' => $userName ] );