Explorar o código

store argon2i password hash in db for be users

Olivier Massot %!s(int64=4) %!d(string=hai) anos
pai
achega
7b99048f2e
Modificáronse 1 ficheiros con 5 adicións e 4 borrados
  1. 5 4
      ot_admin/Classes/Controller/SiteController.php

+ 5 - 4
ot_admin/Classes/Controller/SiteController.php

@@ -19,6 +19,7 @@ use Opentalent\OtCore\Routing\Indexer;
 use PDO;
 use Symfony\Component\Yaml\Yaml;
 use TYPO3\CMS\Core\Cache\Exception\NoSuchCacheException;
+use TYPO3\CMS\Core\Crypto\PasswordHashing\PasswordHashFactory;
 use TYPO3\CMS\Core\Crypto\Random;
 use TYPO3\CMS\Core\Utility\GeneralUtility;
 use TYPO3\CMS\Extbase\Object\ObjectManager;
@@ -2039,7 +2040,7 @@ class SiteController extends ActionController
         $data['network'] = $stmt->fetch();
 
         $stmt = $cnn->prepare(
-            "SELECT p.username, p.id as person_id, s.product
+            "SELECT p.username, p.id as person_id, s.product, p.password
                       FROM opentalent.Person p 
                         INNER JOIN opentalent.Access a ON p.id = a.person_id
                         INNER JOIN opentalent.Settings s on a.organization_id = s.organization_id
@@ -2228,15 +2229,15 @@ class SiteController extends ActionController
             throw new \RuntimeException('Can not find any user with admin access in the Opentalent DB. Abort.');
         }
 
-        // Since we don't want to store the password in the TYPO3 DB, we store a random string instead
-        $randomStr = (new Random)->generateRandomHexString(20);
+        $hashInstance = GeneralUtility::makeInstance(PasswordHashFactory::class)->getDefaultHashInstance('BE');
+        $hashedPassword = $hashInstance->getHashedPassword($userData['password']);
 
         $adminGroup = self::IS_PRODUCT_PREMIUM[$userData['product']] ? self::BEGROUP_ADMIN_PREMIUM : self::BEGROUP_ADMIN_STANDARD;
         $adminGroupUid = $this->getBaseBeGroupUid($adminGroup);
 
         $values = [
             'username' => $userData['username'],
-            'password' => $randomStr,
+            'password' => $hashedPassword,
             'description' => '[Auto-generated] BE Admin for organization ' . $organizationId,
             'deleted' => 0,
             'lang' => 'fr',