namespace changes

Symfony\Component\Security -> Symfony\Component\Security\Core
Symfony\Component\Security\Acl remains unchanged
Symfony\Component\HttpKernel\Security -> Symfony\Component\Security\Http

6 files changed, 353 insertions, 0 deletions

diff --git a/Core/Encoder/BasePasswordEncoder.php b/Core/Encoder/BasePasswordEncoder.php
new file mode 100644
index 0000000..01f471c
--- /dev/null
+++ b/Core/Encoder/BasePasswordEncoder.php
@@ -0,0 +1,91 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien.potencier@symfony-project.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Core\Encoder;
+
+/**
+ * BasePasswordEncoder is the base class for all password encoders.
+ *
+ * @author Fabien Potencier <fabien.potencier@symfony-project.com>
+ */
+abstract class BasePasswordEncoder implements PasswordEncoderInterface
+{
+    /**
+     * Demerges a merge password and salt string.
+     *
+     * @param string $mergedPasswordSalt The merged password and salt string
+     *
+     * @return array An array where the first element is the password and the second the salt
+     */
+    protected function demergePasswordAndSalt($mergedPasswordSalt)
+    {
+        if (empty($mergedPasswordSalt)) {
+            return array('', '');
+        }
+
+        $password = $mergedPasswordSalt;
+        $salt = '';
+        $saltBegins = strrpos($mergedPasswordSalt, '{');
+
+        if (false !== $saltBegins && $saltBegins + 1 < strlen($mergedPasswordSalt)) {
+            $salt = substr($mergedPasswordSalt, $saltBegins + 1, -1);
+            $password = substr($mergedPasswordSalt, 0, $saltBegins);
+        }
+
+        return array($password, $salt);
+    }
+
+    /**
+     * Merges a password and a salt.
+     *
+     * @param string $password the password to be used
+     * @param string $salt the salt to be used
+     *
+     * @return string a merged password and salt
+     */
+    protected function mergePasswordAndSalt($password, $salt)
+    {
+        if (empty($salt)) {
+            return $password;
+        }
+
+        if (false !== strrpos($salt, '{') || false !== strrpos($salt, '}')) {
+            throw new \InvalidArgumentException('Cannot use { or } in salt.');
+        }
+
+        return $password.'{'.$salt.'}';
+    }
+
+    /**
+     * Compares two passwords.
+     *
+     * This method implements a constant-time algorithm to compare passwords to
+     * avoid (remote) timing attacks.
+     *
+     * @param string $password1 The first password
+     * @param string $password2 The second password
+     *
+     * @return Boolean true if the two passwords are the same, false otherwise
+     */
+    protected function comparePasswords($password1, $password2)
+    {
+        if (strlen($password1) !== strlen($password2)) {
+            return false;
+        }
+
+        $result = 0;
+        for ($i = 0; $i < strlen($password1); $i++) {
+            $result |= ord($password1[$i]) ^ ord($password2[$i]);
+        }
+
+        return 0 === $result;
+    }
+}
diff --git a/Core/Encoder/EncoderFactory.php b/Core/Encoder/EncoderFactory.php
new file mode 100644
index 0000000..0f218fe
--- /dev/null
+++ b/Core/Encoder/EncoderFactory.php
@@ -0,0 +1,77 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien.potencier@symfony-project.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Core\Encoder;
+
+use Symfony\Component\Security\Core\User\AccountInterface;
+
+/**
+ * A generic encoder factory implementation
+ *
+ * @author Johannes M. Schmitt <schmittjoh@gmail.com>
+ */
+class EncoderFactory implements EncoderFactoryInterface
+{
+    protected $encoders;
+    protected $encoderMap;
+
+    public function __construct(array $encoderMap)
+    {
+        $this->encoders = array();
+        $this->encoderMap = $encoderMap;
+    }
+
+    /**
+     * {@inheritDoc}
+     */
+    public function getEncoder(AccountInterface $account)
+    {
+        foreach ($this->encoders as $class => $encoder) {
+            if ($account instanceof $class) {
+                return $encoder;
+            }
+        }
+
+        return $this->createEncoder($account);
+    }
+
+    /**
+     * Adds an encoder instance to the factory
+     *
+     * @param string $class
+     * @param PasswordEncoderInterface $encoder
+     * @return void
+     */
+    public function addEncoder($class, PasswordEncoderInterface $encoder)
+    {
+        $this->encoders[$class] = $encoder;
+    }
+
+    /**
+     * Creates the actual encoder instance
+     *
+     * @param AccountInterface $account
+     * @return PasswordEncoderInterface
+     */
+    protected function createEncoder($account)
+    {
+        foreach ($this->encoderMap as $class => $config) {
+            if ($account instanceof $class) {
+                $reflection = new \ReflectionClass($config['class']);
+                $this->encoders[$class] = $reflection->newInstanceArgs($config['arguments']);
+
+                return $this->encoders[$class];
+            }
+        }
+
+        throw new \InvalidArgumentException(sprintf('No encoder has been configured for account "%s".', get_class($account)));
+    }
+}
\ No newline at end of file
diff --git a/Core/Encoder/EncoderFactoryInterface.php b/Core/Encoder/EncoderFactoryInterface.php
new file mode 100644
index 0000000..2bdf6fc
--- /dev/null
+++ b/Core/Encoder/EncoderFactoryInterface.php
@@ -0,0 +1,30 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien.potencier@symfony-project.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Core\Encoder;
+
+use Symfony\Component\Security\Core\User\AccountInterface;
+
+/**
+ * EncoderFactoryInterface to support different encoders for different accounts.
+ *
+ * @author Johannes M. Schmitt <schmittjoh@gmail.com>
+ */
+interface EncoderFactoryInterface
+{
+    /**
+     * Returns the password encoder to use for the given account
+     *
+     * @param AccountInterface $account
+     * @return PasswordEncoderInterface never null
+     */
+    function getEncoder(AccountInterface $account);
+}
\ No newline at end of file
diff --git a/Core/Encoder/MessageDigestPasswordEncoder.php b/Core/Encoder/MessageDigestPasswordEncoder.php
new file mode 100644
index 0000000..811dd4c
--- /dev/null
+++ b/Core/Encoder/MessageDigestPasswordEncoder.php
@@ -0,0 +1,65 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien.potencier@symfony-project.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Core\Encoder;
+
+/**
+ * MessageDigestPasswordEncoder uses a message digest algorithm.
+ *
+ * @author Fabien Potencier <fabien.potencier@symfony-project.com>
+ */
+class MessageDigestPasswordEncoder extends BasePasswordEncoder
+{
+    protected $algorithm;
+    protected $encodeHashAsBase64;
+
+    /**
+     * Constructor.
+     *
+     * @param string  $algorithm          The digest algorithm to use
+     * @param Boolean $encodeHashAsBase64 Whether to base64 encode the password hash
+     * @param integer $iterations         The number of iterations to use to stretch the password hash
+     */
+    public function __construct($algorithm = 'sha256', $encodeHashAsBase64 = false, $iterations = 1)
+    {
+        $this->algorithm = $algorithm;
+        $this->encodeHashAsBase64 = $encodeHashAsBase64;
+        $this->iterations = $iterations;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function encodePassword($raw, $salt)
+    {
+        if (!in_array($this->algorithm, hash_algos(), true)) {
+            throw new \LogicException(sprintf('The algorithm "%s" is not supported.', $this->algorithm));
+        }
+
+        $salted = $this->mergePasswordAndSalt($raw, $salt);
+        $digest = hash($this->algorithm, $salted, true);
+
+        // "stretch" hash
+        for ($i = 1; $i < $this->iterations; $i++) {
+            $digest = hash($this->algorithm, $digest, true);
+        }
+
+        return $this->encodeHashAsBase64 ? base64_encode($digest) : bin2hex($digest);
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function isPasswordValid($encoded, $raw, $salt)
+    {
+        return $this->comparePasswords($encoded, $this->encodePassword($raw, $salt));
+    }
+}
diff --git a/Core/Encoder/PasswordEncoderInterface.php b/Core/Encoder/PasswordEncoderInterface.php
new file mode 100644
index 0000000..393b779
--- /dev/null
+++ b/Core/Encoder/PasswordEncoderInterface.php
@@ -0,0 +1,41 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien.potencier@symfony-project.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Core\Encoder;
+
+/**
+ * PasswordEncoderInterface is the interface for all encoders.
+ *
+ * @author Fabien Potencier <fabien.potencier@symfony-project.com>
+ */
+interface PasswordEncoderInterface
+{
+    /**
+     * Encodes the raw password.
+     *
+     * @param string $raw  The password to encode
+     * @param string $salt The salt
+     *
+     * @return string The encoded password
+     */
+    function encodePassword($raw, $salt);
+
+    /**
+     * Checks a raw password against an encoded password.
+     *
+     * @param string $encoded An encoded password
+     * @param string $raw     A raw password
+     * @param string $salt    The salt
+     *
+     * @return Boolean true if the password is valid, false otherwise
+     */
+    function isPasswordValid($encoded, $raw, $salt);
+}
diff --git a/Core/Encoder/PlaintextPasswordEncoder.php b/Core/Encoder/PlaintextPasswordEncoder.php
new file mode 100644
index 0000000..98982b0
--- /dev/null
+++ b/Core/Encoder/PlaintextPasswordEncoder.php
@@ -0,0 +1,49 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien.potencier@symfony-project.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Core\Encoder;
+
+/**
+ * PlaintextPasswordEncoder does not do any encoding.
+ *
+ * @author Fabien Potencier <fabien.potencier@symfony-project.com>
+ */
+class PlaintextPasswordEncoder extends BasePasswordEncoder
+{
+    protected $ignorePasswordCase;
+
+    public function __construct($ignorePasswordCase = false)
+    {
+        $this->ignorePasswordCase = $ignorePasswordCase;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function encodePassword($raw, $salt)
+    {
+        return $this->mergePasswordAndSalt($raw, $salt);
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function isPasswordValid($encoded, $raw, $salt)
+    {
+        $pass2 = $this->mergePasswordAndSalt($raw, $salt);
+
+        if (!$this->ignorePasswordCase) {
+            return $this->comparePasswords($encoded, $pass2);
+        } else {
+            return $this->comparePasswords(strtolower($encoded), strtolower($pass2));
+        }
+    }
+}