From b5aa1e0071a45fd9633fa3d412d203af084f1cf5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Nikola=20Forr=C3=B3?= <nikola@mraveniste.cc>
Date: Tue, 15 May 2018 18:20:28 +0200
Subject: [PATCH] Use SHA512 for password hashing

---
 cms/Authentication.php | 63 ++++++++++++++++++++++++++++++++++++++++++
 cms/Dockerfile         |  1 +
 2 files changed, 64 insertions(+)
 create mode 100644 cms/Authentication.php

diff --git a/cms/Authentication.php b/cms/Authentication.php
new file mode 100644
index 0000000..17acbb1
--- /dev/null
+++ b/cms/Authentication.php
@@ -0,0 +1,63 @@
+<?php
+namespace Grav\Common\User;
+
+abstract class Authentication
+{
+    /**
+     * Create password hash from plaintext password.
+     *
+     * @param string $password Plaintext password.
+     *
+     * @throws \RuntimeException
+     * @return string|bool
+     */
+    public static function create($password)
+    {
+        if (!$password) {
+            throw new \RuntimeException('Password hashing failed: no password provided.');
+        }
+
+        $hash = self::sha512_crypt($password);
+
+        if (!$hash) {
+            throw new \RuntimeException('Password hashing failed: internal error.');
+        }
+
+        return $hash;
+    }
+
+    /**
+     * Verifies that a password matches a hash.
+     *
+     * @param string $password Plaintext password.
+     * @param string $hash     Hash to verify against.
+     *
+     * @return int              Returns 0 if the check fails, 1 if password matches, 2 if hash needs to be updated.
+     */
+    public static function verify($password, $hash)
+    {
+        // Fail if hash doesn't match
+        if (!$password || !$hash || self::sha512_crypt($password, $hash) != $hash) {
+            return 0;
+        }
+
+        return 1;
+    }
+
+    private static function sha512_crypt($password, $hash = null)
+    {
+        if (!$hash) {
+            $fp = fopen('/dev/urandom', 'r');
+
+            try {
+                $salt = fread($fp, 32);
+            } finally {
+                fclose($fp);
+            }
+
+            $hash = '$6$' . base64_encode($salt);
+        }
+
+        return crypt($password, $hash);
+    }
+}
diff --git a/cms/Dockerfile b/cms/Dockerfile
index f422f19..2e5c074 100644
--- a/cms/Dockerfile
+++ b/cms/Dockerfile
@@ -16,6 +16,7 @@ COPY php-fpm.conf /etc/php7/php-fpm.d/zz-docker.conf
 RUN addgroup -g 9999 lilia
 
 COPY --chown=nobody:lilia grav /app/
+COPY --chown=nobody:lilia Authentication.php /app/system/src/Grav/Common/User/Authentication.php
 
 USER nobody:lilia