upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-06-13 18:50:47 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 32

Don't use slow hashing to check the LDAP binding

Browse source 
Using password_hash is expensive and should be used for hashing
passwords when saving them in the database. Here we just want to see if
the bind was already done with the given password, so use a fast hashing
algorythm.

Signed-off-by: Carl Schwan <carl@carlschwan.eu>
This commit is contained in:
Carl Schwan 2022-05-02 21:46:42 +02:00 committed by backportbot-nextcloud[bot]
parent 5bc5989b3d
commit e3021049f4
1 changed files with 3 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
apps/user_ldap/lib/Connection.php
View file

@ -125,7 +125,7 @@ class Connection extends LDAPUtility {
protected $ignoreValidation = false;
/**
* @var array{dn?: mixed, hash?: string, result?: bool}
* @var array{sum?: string, result?: bool}
*/
protected $bindResult = [];
@ -669,11 +669,7 @@ class Connection extends LDAPUtility {
if (
count($this->bindResult) !== 0
&& $this->bindResult['dn'] === $this->configuration->ldapAgentName
&& \OC::$server->getHasher()->verify(
$this->configPrefix . $this->configuration->ldapAgentPassword,
$this->bindResult['hash']
)
&& $this->bindResult['sum'] === md5($this->configuration->ldapAgentName . $this->configPrefix . $this->configuration->ldapAgentPassword)
) {
// don't attempt to bind again with the same data as before
// bind might have been invoked via getConnectionResource(),
@ -686,8 +682,7 @@ class Connection extends LDAPUtility {
$this->configuration->ldapAgentPassword);
$this->bindResult = [
'dn' => $this->configuration->ldapAgentName,
'hash' => \OC::$server->getHasher()->hash($this->configPrefix . $this->configuration->ldapAgentPassword),
'sum' => md5($this->configuration->ldapAgentName . $this->configPrefix . $this->configuration->ldapAgentPassword),
'result' => $ldapLogin,
];