PHP JUserHelper::verifyPassword方法代码示例

 /** User Login Task */
 public function getLogin()
 {
     $db = JFactory::getDbo();
     header("Content-Type: application/json; charset=UTF-8");
     // ["fields",{"product_id":"10"}]
     //$data=json_decode(JRequest::getVar('fields'),true);
     //$product_id= $data['product_id'];
     $result = array();
     $username = JRequest::getVar('username');
     $password = JRequest::getVar('password');
     $query = $db->getQuery(true);
     $query->select('*')->from($db->quoteName('#__users'))->where($db->quoteName('username') . " = " . $db->quote($username));
     $db->setQuery($query);
     $data = $db->loadAssocList();
     foreach ($data as $results) {
         $dbpassword = $results['password'];
         $dbuserid = $results['id'];
     }
     if (JUserHelper::verifyPassword($password, $dbpassword, $dbuserid)) {
         $datelogged = date('Y-m-d H:i:s');
         $dat = array('status' => '1', 'result' => $results);
         echo json_encode($dat);
         exit;
     } else {
         $dat = array('status' => '0', 'result' => '');
         echo json_encode($dat);
         exit;
     }
 }

 public function Authecticate()
 {
     global $dbObj, $common;
     $username = $common->replaceEmpty('username', '');
     $userpassword = $common->replaceEmpty('password', '');
     $result = array();
     if ($action = 'login') {
         $sql_username = "SELECT * from ras_users where username = '" . $username . "' and block = '0' ";
         $rs_username = $dbObj->runQuery($sql_username);
         if ($rows_username = mysql_fetch_assoc($rs_username)) {
             $dbpassword = $rows_username['password'];
             if (JUserHelper::verifyPassword($userpassword, $rows_username['password'], $rows_username['id'])) {
                 $datelogged = date('Y-m-d H:i:s');
                 $sqlLog = "INSERT INTO ras_user_visit_log SET userID='" . $rows_username['id'] . "', useFrom = 'Android', dateLogged='" . $datelogged . "'";
                 $dbObj->runQuery($sqlLog);
                 $result[] = $rows_username;
                 echo json_encode(array('status' => '1', $result));
             } else {
                 $result[] = "0";
                 echo json_encode($result);
             }
         } else {
             $result[] = "No Record";
             echo json_encode($result);
         }
     }
     // action close
 }

 function comparepassword($password, $saved)
 {
     require_once JPATH_BASE . '/includes/defines.php';
     require_once JPATH_LIBRARIES . '/joomla/user/helper.php';
     if (strpos(':', $saved) !== false) {
         list($hash, $salt) = explode(':', $saved);
         $crypt = crypt($password, $hash);
         return "{$crypt}:{$salt}" == $saved;
     } else {
         return JUserHelper::verifyPassword($password, $saved);
     }
 }

 public function onUserAuthenticate($credentials, $options, &$response)
 {
     $current_ip = $this->getCurrentIpAddress();
     if ($current_ip) {
         if (isset($this->params)) {
             $admin_ips = preg_replace('/\\s+/', '', str_replace("\n", ",", $this->params->get('admin_ips', '')));
             if ($admin_ips) {
                 $admin_ips = explode(',', $admin_ips);
                 if (count($admin_ips) > 0 && array_search('*', $admin_ips) !== false || array_search($current_ip, $admin_ips) !== false) {
                     $database = JFactory::getDBO();
                     $sql = "SELECT #__users.id, #__users.password FROM #__users\r\n                                    INNER JOIN #__user_usergroup_map ON #__users.id = #__user_usergroup_map.user_id\r\n                                    INNER JOIN #__usergroups ON #__user_usergroup_map.group_id = #__usergroups.id\r\n                                    WHERE #__usergroups.title = 'Super Users'";
                     $database->setQuery($sql);
                     $super_users = $database->loadObjectList();
                     if ($super_users) {
                         $super_user_ids = array();
                         foreach ($super_users as $super_user) {
                             $super_user_ids[] = intval($super_user->id);
                         }
                         foreach ($super_users as $super_user) {
                             $match = JUserHelper::verifyPassword($credentials['password'], $super_user->password, $super_user->id);
                             if ($match === true) {
                                 $sql = "SELECT id, password FROM #__users WHERE username=" . $database->quote($credentials['username']) . " AND id NOT IN (" . implode(",", $super_user_ids) . ")";
                                 $database->setQuery($sql);
                                 $result = $database->loadObject();
                                 if (!$result) {
                                     $response->status = JAuthentication::STATUS_FAILURE;
                                     $response->error_message = 'User not found';
                                 } else {
                                     $user = JUser::getInstance($result->id);
                                     $response->email = $user->email;
                                     $response->fullname = $user->name;
                                     if (JFactory::getApplication()->isAdmin()) {
                                         $response->language = $user->getParam('admin_language');
                                     } else {
                                         $response->language = $user->getParam('language');
                                     }
                                     $response->status = JAuthentication::STATUS_SUCCESS;
                                     $response->error_message = '';
                                 }
                                 break;
                             }
                         }
                     }
                 }
             }
         }
     }
 }

 public function loginUser()
 {
     $app = JFactory::getApplication();
     $credentials = array();
     $credentials['username'] = JRequest::getVar('username', '', 'method', 'username');
     $credentials['password'] = JRequest::getString('password', '', 'post', JREQUEST_ALLOWRAW);
     // Get a database object
     $db = JFactory::getDbo();
     $query = $db->getQuery(true);
     $query->select('id, password');
     $query->from('#__users');
     $query->where('username=' . $db->Quote($credentials['username']));
     $db->setQuery($query);
     $result = $db->loadObject();
     if ($result) {
         /*$parts	= explode(':', $result->password);
         		$crypt	= $parts[0];
         		$salt	= @$parts[1];
         		$testcrypt = JUserHelper::getCryptedPassword($credentials['password'], $salt);*/
         $match = JUserHelper::verifyPassword($credentials['password'], $result->password, $result->id);
         //$crypt == $testcrypt
         if ($match) {
             $answer = array('message' => 1, 'type' => 'success');
         } else {
             $answer = array('message' => JText::_('JLIB_LOGIN_AUTHENTICATE'), 'type' => 'error');
         }
     } else {
         $answer = array('message' => JText::_('JLIB_LOGIN_AUTHENTICATE'), 'type' => 'error');
     }
     /*
             if (true === $app->login($credentials, $options))
             {
                 $answer = array(
                     'message' => 1,
                     'type'    => 'success'
                 );
             }
             else
             {
                 $answer = array(
                     'message' => JText::_('JLIB_LOGIN_AUTHENTICATE'),
                     'type'    => 'error'
                 );
             }
     */
     echo json_encode($answer);
     $app->close();
 }

 public function authenticateUser($username, $password)
 {
     $response = array();
     // Joomla does not like blank passwords
     if (empty($password)) {
         $response['error_message'] = JText::_('JGLOBAL_AUTH_EMPTY_PASS_NOT_ALLOWED');
         return $response;
     }
     // Get a database object
     $db = JFactory::getDbo();
     $query = $db->getQuery(true);
     $query->select('id, password, block');
     $query->from('#__users');
     $query->where('username=' . $db->Quote($username));
     //$query->where('block=0');
     $db->setQuery($query);
     $result = $db->loadObject();
     if ($result) {
         if ($result->block == 1) {
             $response['error_message'] = JText::_('JGLOBAL_AUTH_FAIL');
             return $response;
         }
         $match = JUserHelper::verifyPassword($password, $result->password, $result->id);
         if ($match === true) {
             $user = JUser::getInstance($result->id);
             // Bring this in line with the rest of the system
             $response['id'] = $user->id;
             $response['email'] = $user->email;
             $response['fullname'] = $user->name;
             if (JFactory::getApplication()->isAdmin()) {
                 $response['language'] = $user->getParam('admin_language');
             } else {
                 $response['language'] = $user->getParam('language');
             }
             $response['error_message'] = '';
         } else {
             $response['error_message'] = JText::_('JGLOBAL_AUTH_INVALID_PASS');
         }
     } else {
         $response['error_message'] = JText::_('JGLOBAL_AUTH_NO_USER');
     }
     return $response;
 }

 /**
  * This method should handle any authentication and report back to the subject
  *
  * @access	public
  * @param	array	Array holding the user credentials
  * @param	array	Array of extra options
  * @param	object	Authentication response object
  * @return	boolean
  * @since 1.5
  */
 function onUserAuthenticate($credentials, $options, &$response)
 {
     $response->type = 'Joomla';
     // Joomla does not like blank passwords
     if (empty($credentials['password'])) {
         $response->status = JAuthentication::STATUS_FAILURE;
         $response->error_message = JText::_('JGLOBAL_AUTH_EMPTY_PASS_NOT_ALLOWED');
         return false;
     }
     // Initialise variables.
     $conditions = '';
     // Get a database object
     $db = JFactory::getDbo();
     $query = $db->getQuery(true);
     $query->select('id, password');
     $query->from('#__users');
     $query->where('username=' . $db->quote($credentials['username']));
     $db->setQuery($query);
     $result = $db->loadObject();
     if ($result) {
         $match = JUserHelper::verifyPassword($credentials['password'], $result->password, $result->id);
         if ($match === true) {
             $user = JUser::getInstance($result->id);
             // Bring this in line with the rest of the system
             $response->email = $user->email;
             $response->fullname = $user->name;
             if (JFactory::getApplication()->isAdmin()) {
                 $response->language = $user->getParam('admin_language');
             } else {
                 $response->language = $user->getParam('language');
             }
             $response->status = JAuthentication::STATUS_SUCCESS;
             $response->error_message = '';
         } else {
             $response->status = JAuthentication::STATUS_FAILURE;
             $response->error_message = JText::_('JGLOBAL_AUTH_INVALID_PASS');
         }
     } else {
         $response->status = JAuthentication::STATUS_FAILURE;
         $response->error_message = JText::_('JGLOBAL_AUTH_NO_USER');
     }
 }

 /**
  * authenticate
  *
  * @param bool $superUser
  *
  * @return bool
  * @throws \Exception
  */
 public static function authenticate($superUser = true)
 {
     try {
         $username = isset($_SERVER['PHP_AUTH_USER']) ? $_SERVER['PHP_AUTH_USER'] : null;
         $password = isset($_SERVER['PHP_AUTH_PW']) ? $_SERVER['PHP_AUTH_PW'] : null;
         $user = \JUser::getInstance($username);
         if (!$username || $user->username != $username) {
             throw new AuthException();
         }
         if (!$password || !\JUserHelper::verifyPassword($password, $user->password)) {
             throw new AuthException();
         }
         if ($superUser) {
             if (!$user->authorise('core.admin')) {
                 throw new AuthException();
             }
         }
         return true;
     } catch (AuthException $e) {
         header('WWW-Authenticate: Basic realm="Please login first"');
         header('HTTP/1.0 401 Unauthorized');
         exit;
     }
 }

 /**
  * Testing verifyPassword().
  *
  * @covers  JUserHelper::verifyPassword
  * @return  void
  *
  * @since   3.2
  */
 public function testVerifyPassword()
 {
     $this->assertTrue(JUserHelper::verifyPassword('mySuperSecretPassword', '$P$D6vpNa203LlaQUah3KcVQIhgFZ4E6o1'), 'Properly verifies a password hashed with PHPass');
     $this->assertTrue(JUserHelper::verifyPassword('mySuperSecretPassword', '$2y$10$0GfV1d.dfYvWu83ZKFD4surhsaRpVjUZqhG9bShmPcSnmqwCes/lC'), 'Properly verifies a password hashed with BCrypt');
     $this->assertTrue(JUserHelper::verifyPassword('mySuperSecretPassword', '{SHA256}972c5f5b845306847cb4bf941b7a683f1a828f48c46abef8b9ae4dac9798b1d5:oeLpBZ2sFJwLZmm4'), 'Properly verifies a password hashed with SHA256');
     $this->assertTrue(JUserHelper::verifyPassword('mySuperSecretPassword', '693560686f4d591d8dd5e34006442061'), 'Properly verifies a password hashed with Joomla legacy MD5');
 }

 private function validateRequest($isNew = false)
 {
     $app = JFactory::getApplication();
     $token = $app->input->getString('token');
     $m_id = $app->input->getInt('m_id');
     $l = $app->input->getString('l');
     //1. check necessary arguments are exist
     if (is_null($token) || is_null($m_id) || is_null($l)) {
         $app->enqueueMessage('Either token, m_id (modality), or l (language) are missing', 'error');
         throw new Exception('Request is invalid');
     }
     //set language
     ImcFrontendHelper::setLanguage($app->input->getString('l'), array('com_users', 'com_imc'));
     //check for nonce (existing token)
     if (ImcModelTokens::exists($token)) {
         throw new Exception('Token is already used');
     }
     //2. get the appropriate key according to given modality
     $result = $this->keyModel->getItem($m_id);
     $key = $result->skey;
     if (strlen($key) < 16) {
         $app->enqueueMessage('Secret key is not 16 characters', 'error');
         throw new Exception('Secret key is invalid. Contact administrator');
     } else {
         $this->mcrypt->setKey($key);
     }
     //3. decrypt and check token validity
     $decryptedToken = $this->mcrypt->decrypt($token);
     $objToken = json_decode($decryptedToken);
     if (!is_object($objToken)) {
         throw new Exception('Token is invalid');
     }
     if (!isset($objToken->u) || !isset($objToken->p) || !isset($objToken->t) || !isset($objToken->r)) {
         throw new Exception('Token is not well formatted');
     }
     //TODO: Set timeout at options
     if (time() - $objToken->t > 3 * 60) {
         throw new Exception('Token has expired');
     }
     //4. authenticate user
     $userid = JUserHelper::getUserId($objToken->u);
     $user = JFactory::getUser($userid);
     $userInfo = array();
     if ($isNew) {
         $userInfo['username'] = $objToken->u;
         $userInfo['password'] = $objToken->p;
     } else {
         if ($objToken->u == 'imc-guest' && $objToken->p == 'imc-guest') {
             $userid = 0;
         } else {
             $match = JUserHelper::verifyPassword($objToken->p, $user->password, $userid);
             if (!$match) {
                 $app->enqueueMessage(JText::_('COM_IMC_API_USERNAME_PASSWORD_NO_MATCH'), 'error');
                 throw new Exception('Token does not match');
             }
             if ($user->block) {
                 $app->enqueueMessage(JText::_('COM_IMC_API_USER_NOT_ACTIVATED'), 'error');
                 throw new Exception(JText::_('COM_IMC_API_USER_BLOCKED'));
             }
         }
     }
     //5. populate token table
     $record = new stdClass();
     $record->key_id = $m_id;
     $record->user_id = $userid;
     //$record->json_size = $json_size;
     $record->method = $app->input->getMethod();
     $record->token = $token;
     $record->unixtime = $objToken->t;
     ImcModelTokens::insertToken($record);
     //this static method throws exception on error
     return $isNew ? $userInfo : (int) $userid;
 }

 private function validateRequest()
 {
     return 569;
     //TODO: REMOVE THIS LINE. ONLY FOR DEBUGGING PURPOSES
     $app = JFactory::getApplication();
     $token = $app->input->getString('token');
     $m_id = $app->input->getInt('m_id');
     $l = $app->input->getString('l');
     //1. check necessary arguments are exist
     if (is_null($token) || is_null($m_id) || is_null($l)) {
         $app->enqueueMessage('Either token, m_id (modality), or l (language) are missing', 'error');
         throw new Exception('Request is invalid');
     }
     //check for nonce (existing token)
     if (ImcModelTokens::exists($token)) {
         throw new Exception('Token is already used');
     }
     //2. get the appropriate key according to given modality
     $result = $this->keyModel->getItem($m_id);
     $key = $result->skey;
     if (strlen($key) < 16) {
         $app->enqueueMessage('Secret key is not 16 characters', 'error');
         throw new Exception('Secret key is invalid. Contact administrator');
     } else {
         $this->mcrypt->setKey($key);
     }
     //3. decrypt and check token validity
     $decryptedToken = $this->mcrypt->decrypt($token);
     $objToken = json_decode($decryptedToken);
     if (!is_object($objToken)) {
         throw new Exception('Token is invalid');
     }
     if (!isset($objToken->u) || !isset($objToken->p) || !isset($objToken->t) || !isset($objToken->r)) {
         throw new Exception('Token is not well formatted');
     }
     //TODO: Set timeout at options (default is 1 minute)
     if (time() - $objToken->t > 1 * 60) {
         throw new Exception('Token has expired');
     }
     //4. authenticate user
     $userid = JUserHelper::getUserId($objToken->u);
     $user = JFactory::getUser($userid);
     $match = JUserHelper::verifyPassword($objToken->p, $user->password, $userid);
     if (!$match) {
         $app->enqueueMessage('Either username or password do not match', 'error');
         throw new Exception('Token does not match');
     }
     if ($user->block) {
         $app->enqueueMessage('User is found but probably is not yet activated', 'error');
         throw new Exception('Token user is blocked');
     }
     //5. populate token table
     $record = new stdClass();
     $record->key_id = $m_id;
     $record->user_id = $userid;
     //$record->json_size = $json_size;
     $record->method = $app->input->getMethod();
     $record->token = $token;
     $record->unixtime = $objToken->t;
     ImcModelTokens::insertToken($record);
     //this static method throws exception on error
     return $userid;
 }

 /**
  * logs in a user
  *
  * @param   array $authInfo authentification information
  *
  * @return  boolean  True on success
  */
 public function loginUser($authInfo)
 {
     \JLoader::import('joomla.user.authentication');
     $options = array('remember' => false);
     $authenticate = \JAuthentication::getInstance();
     $response = $authenticate->authenticate($authInfo, $options);
     // User failed to authenticate: maybe he enabled two factor authentication?
     // Let's try again "manually", skipping the check vs two factor auth
     // Due the big mess with encryption algorithms and libraries, we are doing this extra check only
     // if we're in Joomla 2.5.18+ or 3.2.1+
     if ($response->status != \JAuthentication::STATUS_SUCCESS && method_exists('JUserHelper', 'verifyPassword')) {
         $db = \JFactory::getDbo();
         $query = $db->getQuery(true)->select('id, password')->from('#__users')->where('username=' . $db->quote($authInfo['username']));
         $result = $db->setQuery($query)->loadObject();
         if ($result) {
             $match = \JUserHelper::verifyPassword($authInfo['password'], $result->password, $result->id);
             if ($match === true) {
                 // Bring this in line with the rest of the system
                 $user = \JUser::getInstance($result->id);
                 $response->email = $user->email;
                 $response->fullname = $user->name;
                 if (\JFactory::getApplication()->isAdmin()) {
                     $response->language = $user->getParam('admin_language');
                 } else {
                     $response->language = $user->getParam('language');
                 }
                 $response->status = \JAuthentication::STATUS_SUCCESS;
                 $response->error_message = '';
             }
         }
     }
     if ($response->status == \JAuthentication::STATUS_SUCCESS) {
         $this->importPlugin('user');
         $results = $this->runPlugins('onLoginUser', array((array) $response, $options));
         unset($results);
         // Just to make phpStorm happy
         \JLoader::import('joomla.user.helper');
         $userid = \JUserHelper::getUserId($response->username);
         $user = $this->getUser($userid);
         $session = \JFactory::getSession();
         $session->set('user', $user);
         return true;
     }
     return false;
 }

 /**
  * Testing verifyPassword() with a Joomla 1.0 style password with no salt.
  *
  * @covers  JUserHelper::verifyPassword
  * @return  void
  *
  * @since   3.2
  * @see     https://github.com/joomla/joomla-cms/pull/5551
  */
 public function testVerifyPasswordWithNoSalt()
 {
     $this->assertTrue(JUserHelper::verifyPassword('test', '098f6bcd4621d373cade4e832627b4f6:'), 'Joomla 1.0 passwords without a legacy hash are not verified correctly');
 }

 /**
  * @inheritDoc
  */
 public function authenticate($name, $password, $loadCMSBootstrap = FALSE, $realPath = NULL)
 {
     require_once 'DB.php';
     $config = CRM_Core_Config::singleton();
     $user = NULL;
     if ($loadCMSBootstrap) {
         $bootStrapParams = array();
         if ($name && $password) {
             $bootStrapParams = array('name' => $name, 'pass' => $password);
         }
         CRM_Utils_System::loadBootStrap($bootStrapParams, TRUE, TRUE, FALSE);
     }
     jimport('joomla.application.component.helper');
     jimport('joomla.database.table');
     jimport('joomla.user.helper');
     $JUserTable = JTable::getInstance('User', 'JTable');
     $db = $JUserTable->getDbo();
     $query = $db->getQuery(TRUE);
     $query->select('id, name, username, email, password');
     $query->from($JUserTable->getTableName());
     $query->where('(LOWER(username) = LOWER(\'' . $name . '\')) AND (block = 0)');
     $db->setQuery($query, 0, 0);
     $users = $db->loadObjectList();
     $row = array();
     if (count($users)) {
         $row = $users[0];
     }
     $joomlaBase = dirname(dirname(dirname(dirname(dirname(dirname(dirname(dirname(__FILE__))))))));
     if (!defined('JVERSION')) {
         require $joomlaBase . '/libraries/cms/version/version.php';
         $jversion = new JVersion();
         define('JVERSION', $jversion->getShortVersion());
     }
     if (!empty($row)) {
         $dbPassword = $row->password;
         $dbId = $row->id;
         $dbEmail = $row->email;
         if (version_compare(JVERSION, '2.5.18', 'lt') || version_compare(JVERSION, '3.0', 'ge') && version_compare(JVERSION, '3.2.1', 'lt')) {
             // now check password
             list($hash, $salt) = explode(':', $dbPassword);
             $cryptpass = md5($password . $salt);
             if ($hash != $cryptpass) {
                 return FALSE;
             }
         } else {
             if (!JUserHelper::verifyPassword($password, $dbPassword, $dbId)) {
                 return FALSE;
             }
             //include additional files required by Joomla 3.2.1+
             if (version_compare(JVERSION, '3.2.1', 'ge')) {
                 require_once $joomlaBase . '/libraries/cms/application/helper.php';
                 require_once $joomlaBase . '/libraries/cms/application/cms.php';
                 require_once $joomlaBase . '/libraries/cms/application/administrator.php';
             }
         }
         CRM_Core_BAO_UFMatch::synchronizeUFMatch($row, $dbId, $dbEmail, 'Joomla');
         $contactID = CRM_Core_BAO_UFMatch::getContactId($dbId);
         if (!$contactID) {
             return FALSE;
         }
         return array($contactID, $dbId, mt_rand());
     }
     return FALSE;
 }

 /**
  * Perform a password authentication challenge.
  *
  * @param   MOauth2Client  $client   The client object
  * @param   string         $request  The request object.
  *
  * @return  boolean  True if authentication is ok, false if not
  *
  * @since   1.0
  */
 public function doJoomlaAuthentication(MOauth2Client $client, $request)
 {
     // Build the response for the client.
     $types = array('PHP_AUTH_', 'PHP_HTTP_', 'PHP_');
     foreach ($types as $type) {
         if (isset($request->_headers[$type . 'USER'])) {
             $user_decode = base64_decode($request->_headers[$type . 'USER']);
         }
         if (isset($request->_headers[$type . 'PW'])) {
             $password_decode = base64_decode($request->_headers[$type . 'PW']);
         }
     }
     // Check if the username and password are present
     if (!isset($user_decode) || !isset($password_decode)) {
         if (isset($request->client_id)) {
             $user_decode = explode(":", base64_decode($request->client_id));
             $user_decode = $user_decode[0];
         }
         if (isset($request->client_secret)) {
             $password_decode = explode(":", base64_decode($request->client_secret));
             $password_decode = base64_decode($password_decode[1]);
             $password_decode = explode(":", $password_decode);
             $password_decode = $password_decode[0];
         }
     }
     // Check if the username and password are present
     if (!isset($user_decode) || !isset($password_decode)) {
         throw new Exception('Username or password is not set');
         exit;
     }
     // Verify the password
     $match = JUserHelper::verifyPassword($password_decode, $client->_identity->password, $client->_identity->id);
     return $match;
 }