Dereku/snappymail
1
0
Fork 0
mirror of https://github.com/the-djmaze/snappymail.git synced 2026-09-03 22:47:03 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

ChangePassword extensions use \SnappyMail\SensitiveString

Browse source
This commit is contained in:
the-djmaze 2024-03-17 14:50:32 +01:00
parent 9427b36633
commit 8c033f53fa
13 changed files with 70 additions and 56 deletions
Download patch file Download diff file Expand all files Collapse all files

14
plugins/change-password/drivers/ldap.php
View file

@ -1,5 +1,7 @@
<?php
use SnappyMail\SensitiveString;
class ChangePasswordDriverLDAP
{
const
@ -55,7 +57,7 @@ class ChangePasswordDriverLDAP
);
}
public function ChangePassword(\RainLoop\Model\Account $oAccount, string $sPrevPassword, string $sNewPassword) : bool
public function ChangePassword(\RainLoop\Model\Account $oAccount, SensitiveString $oPrevPassword, SensitiveString $oNewPassword) : bool
{
$sDomain = \MailSo\Base\Utils::getEmailAddressDomain($oAccount->Email());
$sUserDn = \strtr($this->sUserDnFormat, array(
@ -89,25 +91,25 @@ class ChangePasswordDriverLDAP
throw new \Exception('ldap_start_tls error '.\ldap_errno($oCon).': '.\ldap_error($oCon));
}
if (!\ldap_bind($oCon, $sUserDn, $sPrevPassword)) {
if (!\ldap_bind($oCon, $sUserDn, $oPrevPassword)) {
throw new \Exception('ldap_bind error '.\ldap_errno($oCon).': '.\ldap_error($oCon));
}
$sSshaSalt = '';
$sPrefix = '{'.\strtoupper($this->sPasswordEncType).'}';
$sEncodedNewPassword = $sNewPassword;
$sEncodedNewPassword = $oNewPassword;
switch ($sPrefix)
{
case '{SSHA}':
$sSshaSalt = $this->getSalt(4);
case '{SHA}':
$sEncodedNewPassword = $sPrefix.\base64_encode(\hash('sha1', $sNewPassword.$sSshaSalt, true).$sSshaSalt);
$sEncodedNewPassword = $sPrefix.\base64_encode(\hash('sha1', $oNewPassword.$sSshaSalt, true).$sSshaSalt);
break;
case '{MD5}':
$sEncodedNewPassword = $sPrefix.\base64_encode(\md5($sNewPassword, true));
$sEncodedNewPassword = $sPrefix.\base64_encode(\md5($oNewPassword, true));
break;
case '{CRYPT}':
$sEncodedNewPassword = $sPrefix.\crypt($sNewPassword, $this->getSalt(2));
$sEncodedNewPassword = $sPrefix.\crypt($oNewPassword, $this->getSalt(2));
break;
}

8
plugins/change-password/drivers/pdo.php
View file

@ -1,5 +1,7 @@
<?php
use SnappyMail\SensitiveString;
class ChangePasswordDriverPDO
{
const
@ -58,7 +60,7 @@ class ChangePasswordDriverPDO
);
}
public function ChangePassword(\RainLoop\Model\Account $oAccount, string $sPrevPassword, string $sNewPassword) : bool
public function ChangePassword(\RainLoop\Model\Account $oAccount, SensitiveString $oPrevPassword, SensitiveString $oNewPassword) : bool
{
try
{
@ -85,8 +87,8 @@ class ChangePasswordDriverPDO
$placeholders = array(
':email' => $sEmail,
':oldpass' => $encrypt_prefix . \ChangePasswordPlugin::encrypt($encrypt, $sPrevPassword),
':newpass' => $encrypt_prefix . \ChangePasswordPlugin::encrypt($encrypt, $sNewPassword),
':oldpass' => $encrypt_prefix . \ChangePasswordPlugin::encrypt($encrypt, $oPrevPassword),
':newpass' => $encrypt_prefix . \ChangePasswordPlugin::encrypt($encrypt, $oNewPassword),
':domain' => \MailSo\Base\Utils::getEmailAddressDomain($sEmail),
':username' => \MailSo\Base\Utils::getEmailAddressLocalPart($sEmail),
':login_name' => $oAccount->IncLogin()

20
plugins/change-password/index.php
View file

@ -1,14 +1,15 @@
<?php
use \RainLoop\Exceptions\ClientException;
use RainLoop\Exceptions\ClientException;
use SnappyMail\SensitiveString;
class ChangePasswordPlugin extends \RainLoop\Plugins\AbstractPlugin
{
const
NAME = 'Change Password',
VERSION = '2.20',
RELEASE = '2024-03-12',
REQUIRED = '2.35.3',
VERSION = '2.36',
RELEASE = '2024-03-17',
REQUIRED = '2.36.0',
CATEGORY = 'Security',
DESCRIPTION = 'Extension to allow users to change their passwords';
@ -149,15 +150,16 @@ class ChangePasswordPlugin extends \RainLoop\Plugins\AbstractPlugin
if ($sPrevPassword !== $oAccount->IncPassword()) {
throw new ClientException(static::CurrentPasswordIncorrect, null, $oActions->StaticI18N('NOTIFICATIONS/CURRENT_PASSWORD_INCORRECT'));
}
$oPrevPassword = new \SnappyMail\SensitiveString($sPrevPassword);
$sNewPassword = $this->jsonParam('NewPassword');
if ($this->Config()->Get('plugin', 'pass_min_length', 10) > \strlen($sNewPassword)) {
throw new ClientException(static::NewPasswordShort, null, $oActions->StaticI18N('NOTIFICATIONS/NEW_PASSWORD_SHORT'));
}
if ($this->Config()->Get('plugin', 'pass_min_strength', 70) > static::PasswordStrength($sNewPassword)) {
throw new ClientException(static::NewPasswordWeak, null, $oActions->StaticI18N('NOTIFICATIONS/NEW_PASSWORD_WEAK'));
}
$oNewPassword = new \SnappyMail\SensitiveString($sNewPassword);
$bResult = false;
$oConfig = $this->Config();
@ -171,7 +173,7 @@ class ChangePasswordPlugin extends \RainLoop\Plugins\AbstractPlugin
$oConfig,
$oLogger
);
if (!$oDriver->ChangePassword($oAccount, $sPrevPassword, $sNewPassword)) {
if (!$oDriver->ChangePassword($oAccount, $oPrevPassword, $oNewPassword)) {
throw new ClientException(static::CouldNotSaveNewPassword);
}
$bResult = true;
@ -196,7 +198,7 @@ class ChangePasswordPlugin extends \RainLoop\Plugins\AbstractPlugin
throw new ClientException(static::CouldNotSaveNewPassword);
}
$oAccount->SetPassword($sNewPassword);
$oAccount->SetPassword($oNewPassword);
if ($oAccount instanceof \RainLoop\Model\MainAccount) {
$oActions->SetAuthToken($oAccount);
}
@ -204,7 +206,7 @@ class ChangePasswordPlugin extends \RainLoop\Plugins\AbstractPlugin
return $this->jsonResponse(__FUNCTION__, $oActions->AppData(false));
}
public static function encrypt(string $algo, string $password)
public static function encrypt(string $algo, SensitiveString $password)
{
switch (\strtolower($algo))
{
@ -233,7 +235,7 @@ class ChangePasswordPlugin extends \RainLoop\Plugins\AbstractPlugin
private static function PasswordStrength(string $sPassword) : int
{
$i = \strlen($sPassword);
$max = min(100, $i * 8);
$max = \min(100, $i * 8);
$s = 0;
while (--$i) {
$s += ($sPassword[$i] != $sPassword[$i-1] ? 1 : -0.5);