Switch to User::authenticate

- Removed hash('whirlpool') to check password

include/api.php

@@ -12,6 +12,7 @@ use Friendica\Core\Config;
 use Friendica\Core\NotificationsManager;
 use Friendica\Core\Worker;
 use Friendica\Database\DBM;
+use Friendica\Model\User;
 use Friendica\Network\HTTPException;
 use Friendica\Network\HTTPException\BadRequestException;
 use Friendica\Network\HTTPException\ForbiddenException;
@@ -190,7 +191,6 @@ function api_login(App $a)
 
 	$user = $_SERVER['PHP_AUTH_USER'];
 	$password = $_SERVER['PHP_AUTH_PW'];
-	$encrypted = hash('whirlpool', trim($password));
 
 	// allow "user@server" login (but ignore 'server' part)
 	$at = strstr($user, "@", true);
@@ -218,16 +218,9 @@ function api_login(App $a)
 	if (($addon_auth['authenticated']) && (count($addon_auth['user_record']))) {
 		$record = $addon_auth['user_record'];
 	} else {
-		// process normal login request
+		$user_id = User::authenticate(trim($user), trim($password));
-		$r = q(
+		if ($user_id) {
-			"SELECT * FROM `user` WHERE (`email` = '%s' OR `nickname` = '%s')
+			$record = dba::select('user', [], ['uid' => $user_id], ['limit' => 1]);
-			AND `password` = '%s' AND NOT `blocked` AND NOT `account_expired` AND NOT `account_removed` AND `verified` LIMIT 1",
-			dbesc(trim($user)),
-			dbesc(trim($user)),
-			dbesc($encrypted)
-		);
-		if (DBM::is_result($r)) {
-			$record = $r[0];
 		}
 	}
 

include/auth.php

@@ -4,6 +4,7 @@ use Friendica\App;
 use Friendica\Core\System;
 use Friendica\Core\Config;
 use Friendica\Database\DBM;
+use Friendica\Model\User;
 
 require_once 'include/security.php';
 require_once 'include/datetime.php';
@@ -98,20 +99,23 @@ if (isset($_SESSION) && x($_SESSION, 'authenticated') && (!x($_POST, 'auth-param
 	}
 } else {
 	session_unset();
-	if (x($_POST, 'password') && strlen($_POST['password'])) {
+	if (
-		$encrypted = hash('whirlpool', trim($_POST['password']));
+		!(x($_POST, 'password') && strlen($_POST['password']))
-	} else {
+		&& (
-		if ((x($_POST, 'openid_url')) && strlen($_POST['openid_url']) ||
+			x($_POST, 'openid_url') && strlen($_POST['openid_url'])
-			(x($_POST, 'username')) && strlen($_POST['username'])) {
+			|| x($_POST, 'username') && strlen($_POST['username'])
-
+		)
+	) {
 		$noid = Config::get('system', 'no_openid');
 
-			$openid_url = trim((strlen($_POST['openid_url']) ? $_POST['openid_url'] : $_POST['username']));
+		$openid_url = trim(strlen($_POST['openid_url']) ? $_POST['openid_url'] : $_POST['username']);
 
 		// validate_url alters the calling parameter
+
 		$temp_string = $openid_url;
 
 		// if it's an email address or doesn't resolve to a URL, fail.
+
 		if ($noid || strpos($temp_string, '@') || !validate_url($temp_string)) {
 			$a = get_app();
 			notice(t('Login failed.') . EOL);
@@ -120,6 +124,7 @@ if (isset($_SESSION) && x($_SESSION, 'authenticated') && (!x($_POST, 'auth-param
 		}
 
 		// Otherwise it's probably an openid.
+
 		try {
 			require_once('library/openid.php');
 			$openid = new LightOpenID;
@@ -133,7 +138,6 @@ if (isset($_SESSION) && x($_SESSION, 'authenticated') && (!x($_POST, 'auth-param
 		}
 		// NOTREACHED
 	}
-	}
 
 	if (x($_POST, 'auth-params') && $_POST['auth-params'] === 'login') {
 		$record = null;
@@ -157,18 +161,9 @@ if (isset($_SESSION) && x($_SESSION, 'authenticated') && (!x($_POST, 'auth-param
 		if ($addon_auth['authenticated'] && count($addon_auth['user_record'])) {
 			$record = $addon_auth['user_record'];
 		} else {
-
+			$user_id = User::authenticate(trim($_POST['username']), trim($_POST['password']));
-			// process normal login request
+			if ($user_id) {
-
+				$record = dba::select('user', [], ['uid' => $user_id], ['limit' => 1]);
-			$r = q("SELECT `user`.*, `user`.`pubkey` as `upubkey`, `user`.`prvkey` as `uprvkey`
-				FROM `user` WHERE (`email` = '%s' OR `nickname` = '%s')
-				AND `password` = '%s' AND NOT `blocked` AND NOT `account_expired` AND NOT `account_removed` AND `verified` LIMIT 1",
-				dbesc(trim($_POST['username'])),
-				dbesc(trim($_POST['username'])),
-				dbesc($encrypted)
-			);
-			if (DBM::is_result($r)) {
-				$record = $r[0];
 			}
 		}
 

mod/removeme.php

@@ -26,9 +26,7 @@ function removeme_post(App $a)
 		return;
 	}
 
-	$encrypted = hash('whirlpool',trim($_POST['qxz_password']));
+	if (User::authenticate($a->user['uid'], trim($_POST['qxz_password']))) {
-
-	if ((strlen($a->user['password'])) && ($encrypted === $a->user['password'])) {
 		User::remove($a->user['uid']);
 		// NOTREACHED
 	}

mod/settings.php

@@ -9,6 +9,7 @@ use Friendica\Core\Config;
 use Friendica\Core\PConfig;
 use Friendica\Database\DBM;
 use Friendica\Model\GlobalContact;
+use Friendica\Model\User;
 
 require_once 'include/group.php';
 
@@ -371,7 +372,6 @@ function settings_post(App $a) {
 
 		$newpass = $_POST['password'];
 		$confirm = $_POST['confirm'];
-		$oldpass = hash('whirlpool', $_POST['opassword']);
 
 		$err = false;
 		if ($newpass != $confirm) {
@@ -386,8 +386,7 @@ function settings_post(App $a) {
 
         //  check if the old password was supplied correctly before
         //  changing it to the new value
-        $r = q("SELECT `password` FROM `user`WHERE `uid` = %d LIMIT 1", intval(local_user()));
+        if (User::authenticate(intval(local_user()), $_POST['opassword'])) {
-        if ($oldpass != $r[0]['password']) {
             notice(t('Wrong password.') . EOL);
             $err = true;
         }
@@ -501,9 +500,7 @@ function settings_post(App $a) {
 	if ($email != $a->user['email']) {
 		$email_changed = true;
 		//  check for the correct password
-		$r = q("SELECT `password` FROM `user`WHERE `uid` = %d LIMIT 1", intval(local_user()));
+		if (!User::authenticate(intval(local_user()), $_POST['mpassword'])) {
-		$password = hash('whirlpool', $_POST['mpassword']);
-		if ($password != $r[0]['password']) {
 			$err .= t('Wrong Password') . EOL;
 			$email = $a->user['email'];
 		}

src/Util/ExAuth.php

@@ -37,6 +37,7 @@ namespace Friendica\Util;
 use Friendica\Core\Config;
 use Friendica\Core\PConfig;
 use Friendica\Database\DBM;
+use Friendica\Model\User;
 use dba;
 
 require_once 'include/dba.php';
@@ -217,8 +218,8 @@ class ExAuth
 
 			$aUser = dba::select('user', ['uid', 'password'], ['nickname' => $sUser], ['limit' => 1]);
 			if (DBM::is_result($aUser)) {
-				$uid = $aUser['uid'];
+				$uid = User::authenticate($aUser, $aCommand[3]);
-				$Error = $aUser['password'] != hash('whirlpool', $aCommand[3]);
+				$Error = $uid === false;
 			} else {
 				$this->writeLog(LOG_WARNING, 'user not found: ' . $sUser);
 				$Error = true;