3 * Password policy checks
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License as published by
7 * the Free Software Foundation; either version 2 of the License, or
8 * (at your option) any later version.
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
15 * You should have received a copy of the GNU General Public License along
16 * with this program; if not, write to the Free Software Foundation, Inc.,
17 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
18 * http://www.gnu.org/copyleft/gpl.html
23 use Cdb\Reader
as CdbReader
;
24 use MediaWiki\MediaWikiServices
;
25 use Wikimedia\PasswordBlacklist
;
28 * Functions to check passwords against a policy requirement.
30 * $policyVal is the value configured in $wgPasswordPolicy. If the return status is fatal,
31 * the user won't be allowed to login. If the status is not good but not fatal, the user
32 * will not be allowed to set the given password (on registration or password change),
33 * but can still log in after bypassing a warning.
36 * @see $wgPasswordPolicy
38 class PasswordPolicyChecks
{
41 * Check password is longer than minimum, not fatal.
42 * @param int $policyVal minimal length
44 * @param string $password
45 * @return Status error if $password is shorter than $policyVal
47 public static function checkMinimalPasswordLength( $policyVal, User
$user, $password ) {
48 $status = Status
::newGood();
49 if ( $policyVal > strlen( $password ) ) {
50 $status->error( 'passwordtooshort', $policyVal );
56 * Check password is longer than minimum, fatal.
57 * Intended for locking out users with passwords too short to trust, requiring them
58 * to recover their account by some other means.
59 * @param int $policyVal minimal length
61 * @param string $password
62 * @return Status fatal if $password is shorter than $policyVal
64 public static function checkMinimumPasswordLengthToLogin( $policyVal, User
$user, $password ) {
65 $status = Status
::newGood();
66 if ( $policyVal > strlen( $password ) ) {
67 $status->fatal( 'passwordtooshort', $policyVal );
73 * Check password is shorter than maximum, fatal.
74 * Intended for preventing DoS attacks when using a more expensive password hash like PBKDF2.
75 * @param int $policyVal maximum length
77 * @param string $password
78 * @return Status fatal if $password is shorter than $policyVal
80 public static function checkMaximalPasswordLength( $policyVal, User
$user, $password ) {
81 $status = Status
::newGood();
82 if ( $policyVal < strlen( $password ) ) {
83 $status->fatal( 'passwordtoolong', $policyVal );
89 * Check if username and password are a (case-insensitive) match.
90 * @param bool $policyVal true to force compliance.
92 * @param string $password
93 * @return Status error if username and password match, and policy is true
95 public static function checkPasswordCannotMatchUsername( $policyVal, User
$user, $password ) {
96 $status = Status
::newGood();
97 $username = $user->getName();
98 $contLang = MediaWikiServices
::getInstance()->getContentLanguage();
100 $policyVal && hash_equals( $contLang->lc( $username ), $contLang->lc( $password ) )
102 $status->error( 'password-name-match' );
108 * Check if username and password are on a blacklist of past MediaWiki default passwords.
109 * @param bool $policyVal true to force compliance.
111 * @param string $password
112 * @return Status error if username and password match, and policy is true
114 public static function checkPasswordCannotMatchBlacklist( $policyVal, User
$user, $password ) {
115 static $blockedLogins = [
116 'Useruser' => 'Passpass', 'Useruser1' => 'Passpass1', # r75589
117 'Apitestsysop' => 'testpass', 'Apitestuser' => 'testpass' # r75605
120 $status = Status
::newGood();
121 $username = $user->getName();
124 isset( $blockedLogins[$username] ) &&
125 hash_equals( $blockedLogins[$username], $password )
127 $status->error( 'password-login-forbidden' );
130 // Example from ApiChangeAuthenticationRequest
131 if ( hash_equals( 'ExamplePassword', $password ) ) {
132 $status->error( 'password-login-forbidden' );
139 * Ensure that password isn't in top X most popular passwords, as defined by
140 * $wgPopularPasswordFile.
142 * @param int $policyVal Cut off to use. Will automatically shrink to the max
143 * supported for error messages if set to more than max number of passwords on file,
144 * so you can use the PHP_INT_MAX constant here safely.
146 * @param string $password
148 * @deprecated since 1.33
150 * @see $wgPopularPasswordFile
152 public static function checkPopularPasswordBlacklist( $policyVal, User
$user, $password ) {
153 global $wgPopularPasswordFile, $wgSitename;
154 $status = Status
::newGood();
155 if ( $policyVal > 0 ) {
156 $langEn = Language
::factory( 'en' );
157 $passwordKey = $langEn->lc( trim( $password ) );
159 // People often use the name of the current site, which won't be
160 // in the common password file. Also check '' for people who use
162 $sitename = $langEn->lc( trim( $wgSitename ) );
163 $hardcodedCommonPasswords = [ '', 'wiki', 'mediawiki', $sitename ];
164 if ( in_array( $passwordKey, $hardcodedCommonPasswords ) ) {
165 $status->error( 'passwordtoopopular' );
169 // This could throw an exception, but there's not a good way
170 // of failing gracefully, if say the file is missing, so just
171 // let the exception fall through.
172 // Format of cdb file is mapping password => popularity rank.
173 // See maintenance/createCommonPasswordCdb.php
174 $db = CdbReader
::open( $wgPopularPasswordFile );
176 $res = $db->get( $passwordKey );
177 if ( $res && (int)$res <= $policyVal ) {
178 // Note: If you want to find the true number of common
179 // passwords stored (for reporting the error), you have to take
180 // the max of the policyVal and $db->get( '_TOTALENTRIES' ).
181 $status->error( 'passwordtoopopular' );
188 * Ensure the password isn't in the list of passwords blacklisted by the
189 * wikimedia/password-blacklist library, which contains (as of 0.1.4) the
190 * 100.000 top passwords from SecLists (as a Bloom filter, with an
191 * 0.000001 false positive ratio).
193 * @param bool $policyVal Whether to apply this policy
195 * @param string $password
201 public static function checkPasswordNotInLargeBlacklist( $policyVal, User
$user, $password ) {
202 $status = Status
::newGood();
203 if ( $policyVal && PasswordBlacklist\PasswordBlacklist
::isBlacklisted( $password ) ) {
204 $status->error( 'passwordinlargeblacklist' );