Update authentication to use PhpBB version 3.

This adds an external hash library, to match the new password hashing
used by phpbb3.

diff --git a/auth.py b/auth.py
index 00c106d1e36625e6571d045c2d8604cdbf399b0e..9d8566f9a4aa3889ee066cb939f7b429ae5fc7b2 100644 (file)
--- a/auth.py
+++ b/auth.py
@@ -1,8 +1,7 @@
 from django.conf import settings
 from django.contrib.auth.models import User, check_password
-import md5
 import MySQLdb
-
+import tools.phpass
 
 """
 This auth backend allows django to authenticate against an external phpbb
@@ -22,6 +21,9 @@ own database settings are used. This means, that, usually, you only have to
 specify the database name where phpbb lives.
 """
 class PhpBBBackend:
+    def __init__(self):
+        self.hash = tools.phpass.PasswordHash()
+
     def connect(self):
         host     = getattr(settings, 'PHPBB_DATABASE_HOST',     settings.DATABASE_HOST)
         port     = getattr(settings, 'PHPBB_DATABASE_PORT',     settings.DATABASE_PORT)
@@ -56,10 +58,11 @@ class PhpBBBackend:
 
     def check_login(self, username, password):
         conn = self.connect()
+        prefix = getattr(settings, 'PHPBB_TABLE_PREFIX',   '')
 
         # Get some data
         cursor = conn.cursor ()
-        cursor.execute ("SELECT user_password,user_email FROM users WHERE username=%s", username)
+        cursor.execute ("SELECT user_password,user_email FROM %susers WHERE username=%%s" % prefix, username)
 
         # No data? No login.
         if (cursor.rowcount == 0):
@@ -70,7 +73,7 @@ class PhpBBBackend:
         row = cursor.fetchone()
         conn.close()
 
-        if (md5.new(password).hexdigest() == row[0]):
+        if (self.hash.check_password(password, row[0])):
             return row[1]
         else:
             return False

diff --git a/dbsettings.py.tmpl b/dbsettings.py.tmpl
index 04242fe6a0922fd9837eb3032c1e8ea3d314040c..5ce17d989f3cfc2af3bc9edeff2f76d7ccd86f7f 100644 (file)
--- a/dbsettings.py.tmpl
+++ b/dbsettings.py.tmpl
@@ -11,3 +11,4 @@ DATABASE_PORT = ''                  # Set to empty string for default. Not used
 # Database to use for phpbb authentication. Other variables from above
 # (except for ENGINE) can similarly be overridden.
 PHPBB_DATABASE_NAME = 'ee_forum'
+PHPBB_TABLE_PREFIX = 'phpbb_'

diff --git a/tools/phpass/README b/tools/phpass/README
new file mode 100644 (file)
index 0000000..8d82cb4
--- /dev/null
+++ b/tools/phpass/README
@@ -0,0 +1,18 @@
+Portable PHP password hashing framework implemented in Python.
+
+This Python implementation meant to be and exact port of the the original PHP 
+version.
+
+PHPass is used by WordPress, bbPress, Vanilla Forums, PivotX and phpBB. This 
+Python port will be handy to work with user account data imported from those 
+applications (only the portable password hashes though).
+
+The original PHP version: http://www.openwall.com/phpass/
+PHP version written by Solar Designer.
+
+Python implementation by exavolt <exavolt@gmail.com>
+
+All files within this package are in public domain.
+
+Dependencies:
+ * bcrypt http://www.mindrot.org/projects/py-bcrypt/ (optional)

diff --git a/tools/phpass/__init__.py b/tools/phpass/__init__.py
new file mode 100644 (file)
index 0000000..68e3de0
--- /dev/null
+++ b/tools/phpass/__init__.py
@@ -0,0 +1,194 @@
+#!/usr/bin/env python
+# 
+# phpass version: 0.3 / genuine.
+# 
+# Placed in public domain
+# 
+
+#CHECK: use pyDES instead of the native crypt module?
+
+import os
+import time
+import hashlib
+import crypt
+
+
+try:
+    import bcrypt
+    _bcrypt_hashpw = bcrypt.hashpw
+except ImportError:
+    _bcrypt_hashpw = None
+
+# On App Engine, this function is not available.
+if hasattr(os, 'getpid'):
+    _pid = os.getpid()
+else:
+    # Fake PID
+    import random
+    _pid = random.randint(0, 100000)
+
+
+class PasswordHash:
+    
+    def __init__(self, iteration_count_log2=8, portable_hashes=True, 
+         algorithm=''):
+        alg = algorithm.lower()
+        if (alg == 'blowfish' or alg == 'bcrypt') and _bcrypt_hashpw is None:
+            raise NotImplementedError('The bcrypt module is required')
+        self.itoa64 = \
+            './0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz'
+        if iteration_count_log2 < 4 or iteration_count_log2 > 31:
+            iteration_count_log2 = 8
+        self.iteration_count_log2 = iteration_count_log2
+        self.portable_hashes = portable_hashes
+        self.algorithm = algorithm
+        self.random_state = '%r%r' % (time.time(), _pid)
+    
+    def get_random_bytes(self, count):
+        outp = ''
+        try:
+            outp = os.urandom(count)
+        except:
+            pass
+        if len(outp) < count:
+            outp = ''
+            rem = count
+            while rem > 0:
+                self.random_state = hashlib.md5(str(time.time()) 
+                    + self.random_state).hexdigest()
+                outp += hashlib.md5(self.random_state).digest()
+                rem -= 1
+            outp = outp[:count]
+        return outp
+    
+    def encode64(self, inp, count):
+        outp = ''
+        cur = 0
+        while cur < count:
+            value = ord(inp[cur])
+            cur += 1
+            outp += self.itoa64[value & 0x3f]
+            if cur < count:
+                value |= (ord(inp[cur]) << 8)
+            outp += self.itoa64[(value >> 6) & 0x3f]
+            if cur >= count:
+                break
+            cur += 1
+            if cur < count:
+                value |= (ord(inp[cur]) << 16)
+            outp += self.itoa64[(value >> 12) & 0x3f]
+            if cur >= count:
+                break
+            cur += 1
+            outp += self.itoa64[(value >> 18) & 0x3f]
+        return outp
+    
+    def gensalt_private(self, inp):
+        outp = '$P$'
+        outp += self.itoa64[min([self.iteration_count_log2 + 5, 30])]
+        outp += self.encode64(inp, 6)
+        return outp
+    
+    def crypt_private(self, pw, setting):
+        outp = '*0'
+        if setting.startswith(outp):
+            outp = '*1'
+        if not setting.startswith('$P$') and not setting.startswith('$H$'):
+            return outp
+        count_log2 = self.itoa64.find(setting[3])
+        if count_log2 < 7 or count_log2 > 30:
+            return outp
+        count = 1 << count_log2
+        salt = setting[4:12]
+        if len(salt) != 8:
+            return outp
+        if not isinstance(pw, str):
+            pw = pw.encode('utf-8')
+        hx = hashlib.md5(salt + pw).digest()
+        while count:
+            hx = hashlib.md5(hx + pw).digest()
+            count -= 1
+        return setting[:12] + self.encode64(hx, 16)
+    
+    def gensalt_extended(self, inp):
+        count_log2 = min([self.iteration_count_log2 + 8, 24])
+        count = (1 << count_log2) - 1
+        outp = '_'
+        outp += self.itoa64[count & 0x3f]
+        outp += self.itoa64[(count >> 6) & 0x3f]
+        outp += self.itoa64[(count >> 12) & 0x3f]
+        outp += self.itoa64[(count >> 18) & 0x3f]
+        outp += self.encode64(inp, 3)
+        return outp
+    
+    def gensalt_blowfish(self, inp):
+        itoa64 = \
+            './ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'
+        outp = '$2a$'
+        outp += chr(ord('0') + self.iteration_count_log2 / 10)
+        outp += chr(ord('0') + self.iteration_count_log2 % 10)
+        outp += '$'
+        cur = 0
+        while True:
+            c1 = ord(inp[cur])
+            cur += 1
+            outp += itoa64[c1 >> 2]
+            c1 = (c1 & 0x03) << 4
+            if cur >= 16:
+                outp += itoa64[c1]
+                break
+            c2 = ord(inp[cur])
+            cur += 1
+            c1 |= c2 >> 4
+            outp += itoa64[c1]
+            c1 = (c2 & 0x0f) << 2
+            c2 = ord(inp[cur])
+            cur += 1
+            c1 |= c2 >> 6
+            outp += itoa64[c1]
+            outp += itoa64[c2 & 0x3f]
+        return outp
+    
+    def hash_password(self, pw):
+        rnd = ''
+        alg = self.algorithm.lower()
+        if (not alg or alg == 'blowfish' or alg == 'bcrypt') \
+             and not self.portable_hashes:
+            if _bcrypt_hashpw is None:
+                if (alg == 'blowfish' or alg == 'bcrypt'):
+                    raise NotImplementedError('The bcrypt module is required')
+            else:
+                rnd = self.get_random_bytes(16)
+                salt = self.gensalt_blowfish(rnd)
+                hx = _bcrypt_hashpw(pw, salt)
+                if len(hx) == 60:
+                    return hx
+        if (not alg or alg == 'ext-des') and not self.portable_hashes:
+            if len(rnd) < 3:
+                rnd = self.get_random_bytes(3)
+            hx = crypt.crypt(pw, self.gensalt_extended(rnd))
+            if len(hx) == 20:
+                return hx
+        if len(rnd) < 6:
+            rnd = self.get_random_bytes(6)
+        hx = self.crypt_private(pw, self.gensalt_private(rnd))
+        if len(hx) == 34:
+            return hx
+        return '*'
+    
+    def check_password(self, pw, stored_hash):
+        # This part is different with the original PHP
+        if stored_hash.startswith('$2a$'):
+            # bcrypt
+            if _bcrypt_hashpw is None:
+                raise NotImplementedError('The bcrypt module is required')
+            hx = _bcrypt_hashpw(pw, stored_hash)
+        elif stored_hash.startswith('_'):
+            # ext-des
+            hx = crypt.crypt(pw, stored_hash)
+        else:
+            # portable hash
+            hx = self.crypt_private(pw, stored_hash)
+        return hx == stored_hash
+    
+