Authenticating against phpass hashes with Yii Follow @yiiframework

I played with a few different extensions but think this makes sense.

Should it update non-encrypted passwords with the new hash? It seems like it hits the "Password Incorrect" Error and stops.

Do I need to apply a hash to all my data first?

It seems like this was meant to deal with unhashed passwords but it doesn't work for me.

I removed the md5 reference as my passwords were unhashed initially, that seems to allow the upgrade to hashed passwords without users knowing.
Thanks again! 
//Is this a vanilla hash?
    if($record->password{0}!=='$')
    {
      $record->password=$ph->HashPassword($this->password);
      $record->save();
    }

FWIW I also had to add array('password1, password2', 'safe'), to the rules using yii 1.1.13. Without that line $this->password1 and $this->password2 are always blank in beforeSave. Adding just password1 as safe would not update the password successfully.

Thanks for a great article. Very informative and easy to implement.

*Edit: It may be worth noting that I integrated the above into the yii-user extenstion (http://www.yiiframework.com/extension/yii-user/)

Uhm, well ... attributes are considered safe if they are covered by any rule in the current scenario. Could be that this is what is happening with password1. Could you try to declare just the password1 attribute as safe?

Hi,

I was wondering, do I need to add this in rule, in addition to compare line?

public function rules()
    {
        // NOTE: you should only define rules for those attributes that
        // will receive user inputs.
        return array(
            ...
            array('password2', 'compare', 'compareAttribute'=>'password1'),
            array('password1, password2', 'safe'),
            ...
        );
    }

Without declaring as safe, I cannot go inside the if body although meet the condition.

public function beforeSave()
    {
        if(!empty($this->password1) && $this->password1==$this->password2)
        {
            $ph=new PasswordHash(Yii::app()->params['phpass']['iteration_count_log2'], Yii::app()->params['phpass']['portable_hashes']);
            $this->password=$ph->HashPassword($this->password1);
        } 
 
        return parent::beforeSave();
    }

Thank you for the great and helpful wiki!

Daniel

Need help if anyone has had this problem after configuring phpass on my yii app and tested on my local machine am able to login but moving to production server it wont log me in. Tried my other host and works fine. The prod is running on php5.2 and the local and other hosting are running php5.3. Thanks.

Will check and still in dev

That's mighty strange. You should better check which rule it is that's missfiring (if it is missfiring) in User.rules(). Just using save(false) is no good workaround.

//Is this a vanilla hash?
    if($record->password{0}!=='$')
    {
      $record->password=$ph->HashPassword($this->password);
      $record->save();
    }

Trying to encrypt existing passwords with this method. I had issues with my app until I had to add false in the save method. As in

//Is this a vanilla hash?
    if($record->password{0}!=='$')
    {
      $record->password=$ph->HashPassword($this->password);
      $record->save(false);
    }

Though thanks for your effort.

Yes, indeed. Thanks for the pointer. That must have slipped in during clean-up.

Shouldn't the following line in your beforeSave example be updated from this:

$this->password=$ph->HashPassword($this->password);

to this?

$this->password=$ph->HashPassword($this->password1); // note the 1

Because you want to test the passwords against themselves and then, if they match, you want to hash the password and then save the hash into the password variable. Correct?

Thanks for reporting this. This hasn't come to my attention either. But it looks like the authors took care of that about 10 months ago. Their fix is identical to yours. Unfortunately, it hasn't made it in any release yet.

Hi,

a customer stumbled across a problem with phpass today: the extension tries to check if /dev/urandom is readable (File PasswordHash.php, Line 51). If the server enforces an open_basedir setting, the call to is_readable will throw an php error (open_basedir restriction in effect - you do not want to add /dev to open_basedir!) which breaks the application.

This slipped through my test environment as it is not using open_basedir :(

Add an @ before the is_readable call to fix this problem.

I will try to contact the original author of this file about this problem.

I see. It would still be interesting to know how often that happens.

It is simply a good practice in our development model to catch the "black swan" unexpected events especially when it comes to security

Hm, interesting. How often does hashing fail? I've always thought of phpass to be quite failsafe.

There is an easy way to ensure the hash was successful. Here is a sample method we use...

public function securePassword($password)
{
    //Instantiate object with configuration
    $passwordHash = new PasswordHash(Yii::app()->params['phpass']['iteration_count)_log2'],Yii::app()->params['phpass']['portable_hashes']);
     //Hash the passed password
     $securedPassword = $passwordHash->HashPassword($password);
     unset($passwordHash);
 
     If (strlen($securedPassword < 20))  //smallest hash is 20 characters
     {
         return false;
     } 
     else
     {
         return $securedPassword;
     }
}

In hindsight, the solution with User.beforeSave() isn't that great. If an existing User would be updated, the hashed password might be hashed again, thus making logging in impossible. I'll need to refine that example soon.

Edit: Should be all good now.

This is a good option..... I gonna test