FreshRSS/app/Models/FormAuth.php

<?php
declare(strict_types=1);

class FreshRSS_FormAuth {
	public const MIN_PASSWORD_LENGTH = 7; // Only to be enforced when setting new passwords.
	public const MAX_PASSWORD_LENGTH = 72; // Bcrypt limits password lengths to 72 bytes.

	/**
	 * @param array{enforceMinLength?: bool} $options
	 */
	public static function passwordRequirementsMet(#[\SensitiveParameter] string $passwordPlain, array $options = []): bool {
		$enforceMinLength = ($options['enforceMinLength'] ?? true) === true;
		if (strlen($passwordPlain) > self::MAX_PASSWORD_LENGTH) {
			return false;
		}
		if ($enforceMinLength && strlen($passwordPlain) < self::MIN_PASSWORD_LENGTH) {
			return false;
		}
		if (trim($passwordPlain) === '') {
			return false;
		}
		return true;
	}

	public static function checkCredentials(string $username, #[\SensitiveParameter] string $hash, #[\SensitiveParameter] string $passwordPlain): bool {
		if (!FreshRSS_user_Controller::checkUsername($username) || !ctype_graph($hash)) {
			Minz_Log::debug("Invalid credential parameters: user={$username}");
			return false;
		}

		// Expecting bcrypt format, see: https://en.wikipedia.org/wiki/Bcrypt#Description
		// FreshRSS has not historically used any other algorithm for password hash generation,
		// so no upgrades are required.
		if (!preg_match('/^\$2[aby]\$(0[4-9]|10)\$[.\/0-9A-Za-z]{53}$/', $hash)) {
			Minz_Log::debug("Invalid hash format: user={$username}");
			return false;
		}

		$byteLen = strlen($passwordPlain);
		$utf8Prefix = mb_check_encoding($passwordPlain, 'UTF-8')
			? mb_strcut($passwordPlain, 0, self::MAX_PASSWORD_LENGTH, 'UTF-8')
			: '';

		$cutOffUtf8Character = $byteLen > self::MAX_PASSWORD_LENGTH &&
			strlen($utf8Prefix) < self::MAX_PASSWORD_LENGTH &&
			mb_strlen($passwordPlain, 'UTF-8') === mb_strlen($utf8Prefix, 'UTF-8') + 1;

		// Only reject logging in with a password longer than 72 bytes if the limit does not
		// cut off a valid UTF-8 character, since this may be an existing bcrypt password.
		if (!$cutOffUtf8Character && $byteLen > self::MAX_PASSWORD_LENGTH) {
			Minz_Log::warning("Exceeded maximum allowed password length during authentication: user={$username}");
			return false;
		}

		// https://www.php.net/manual/function.password-verify.php
		if (password_verify($passwordPlain, $hash)) {
			if (trim($passwordPlain) === '') {
				Minz_Log::warning("Refusing authentication with empty zero-length password: user={$username}");
				return false;
			}
			return true;
		}

		return false;
	}

	/**
	 * @return array{username: string, password: string}
	 */
	public static function getAutofilledFields(bool $raw = false): array {
		$username = Minz_ExtensionManager::callHook(Minz_HookType::AutofillField, 'username');
		$password = Minz_ExtensionManager::callHook(Minz_HookType::AutofillField, 'password');

		$fields = [
			'username' => is_string($username) ? $username : '',
			'password' => is_string($password) ? $password : '',
		];

		if (!$raw) {
			foreach ($fields as $k => $v) {
				$fields[$k] = htmlspecialchars($v, ENT_COMPAT, 'UTF-8');
			}
		}

		return $fields;
	}

	/** @return list<string> */
	public static function getCredentialsFromCookie(): array {
		$token = Minz_Session::getLongTermCookie('FreshRSS_login');
		if (!ctype_alnum($token)) {
			return [];
		}

		$token_file = DATA_PATH . '/tokens/' . $token . '.txt';
		$mtime = @filemtime($token_file) ?: 0;
		$limits = FreshRSS_Context::systemConf()->limits;
		$cookie_duration = empty($limits['cookie_duration']) ? FreshRSS_Auth::DEFAULT_COOKIE_DURATION : $limits['cookie_duration'];
		if ($mtime + $cookie_duration < time()) {
			// Token has expired (> cookie_duration) or does not exist.
			@unlink($token_file);
			return [];
		}

		$credentials = @file_get_contents($token_file);
		if ($credentials !== false && self::renewCookie($token) != false) {
			return explode("\t", $credentials, 2);
		}
		return [];
	}

	private static function renewCookie(string $token): string|false {
		$token_file = DATA_PATH . '/tokens/' . $token . '.txt';
		if (touch($token_file)) {
			$limits = FreshRSS_Context::systemConf()->limits;
			$cookie_duration = empty($limits['cookie_duration']) ? FreshRSS_Auth::DEFAULT_COOKIE_DURATION : $limits['cookie_duration'];
			$expire = time() + $cookie_duration;
			Minz_Session::setLongTermCookie('FreshRSS_login', $token, $expire);
			return $token;
		}
		return false;
	}

	public static function makeCookie(string $username, #[\SensitiveParameter] string $password_hash): string|false {
		do {
			$token = hash('sha256', FreshRSS_Context::systemConf()->salt . $username . random_bytes(32));
			$token_file = DATA_PATH . '/tokens/' . $token . '.txt';
		} while (file_exists($token_file));

		if (@file_put_contents($token_file, $username . "\t" . $password_hash) === false) {
			return false;
		}

		return self::renewCookie($token);
	}

	public static function deleteCookie(): void {
		$token = Minz_Session::getLongTermCookie('FreshRSS_login');
		if (ctype_alnum($token)) {
			Minz_Session::deleteLongTermCookie('FreshRSS_login');
			@unlink(DATA_PATH . '/tokens/' . $token . '.txt');
		}

		if (rand(0, 10) === 1) {
			self::purgeTokens();
		}
	}

	public static function purgeTokens(): void {
		$limits = FreshRSS_Context::systemConf()->limits;
		$cookie_duration = empty($limits['cookie_duration']) ? FreshRSS_Auth::DEFAULT_COOKIE_DURATION : $limits['cookie_duration'];
		$oldest = time() - $cookie_duration;
		foreach (new DirectoryIterator(DATA_PATH . '/tokens/') as $file_info) {
			$extension = $file_info->getExtension();
			if ($extension === 'txt' && $file_info->getMTime() < $oldest) {
				@unlink($file_info->getPathname());
			}
		}
	}
}