Merged in julceslau/processmaker (pull request #850)

Fixing many issues related to password hash method changed

gulliver/system/class.bootstrap.php

@@ -2860,28 +2860,43 @@ class Bootstrap
         }
     }
 
-    public function getPasswordHashType()
+    public function getPasswordHashConfig()
     {
-        G::LoadClass( "configuration" );
+        G::LoadClass('configuration');
         $config= new Configurations();
-        return $config->getConfiguration('ENTERPRISE_SETTING_ENCRYPT', '');
+        $passwordHashConfig = $config->getConfiguration('ENTERPRISE_SETTING_ENCRYPT', '');
+        if (!is_null($passwordHashConfig)) {
+            if (!is_array($passwordHashConfig)) {
+                $passwordHashConfig = array();
+            }
+            if (!isset($passwordHashConfig['current'])) {
+                $passwordHashConfig['current'] = 'md5';
+            }
+            if (!isset($passwordHashConfig['previous'])) {
+                $passwordHashConfig['previous'] = 'md5';
+            }
+        } else {
+            $passwordHashConfig = array('current' => 'md5', 'previous' => 'md5');
+        }
+        return $passwordHashConfig;
     }
 
-    public function hashPassword($pass, $hashType = '', $includeHashType = false, $hashOld = false)
+    public function getPasswordHashType()
     {
-        $typeEncrypt = ($hashType != '') ? $hashType : Bootstrap::getPasswordHashType();
-        $encrypt = 'md5';
-        if ($typeEncrypt != null) {
-            if (isset($typeEncrypt['current']) && $typeEncrypt['current'] != '') {
-                $encrypt = $typeEncrypt['current'];
-            }
-            if ($hashOld && isset($typeEncrypt['previous']) && $typeEncrypt['previous'] != '' ) {
-                $encrypt = $typeEncrypt['previous'];
-            }
+        $passwordHashConfig = Bootstrap::getPasswordHashConfig();
+        return $passwordHashConfig['current'];
+    }
+
+    public function hashPassword($pass, $hashType = '', $includeHashType = false)
+    {
+        if ($hashType == '') {
+            $hashType = Bootstrap::getPasswordHashType();
         }
-        eval("\$var = hash('" . $encrypt . "', '" . $pass . "');");
+
+        eval("\$var = hash('" . $hashType . "', '" . $pass . "');");
+
         if ($includeHashType) {
-            $var = $encrypt . ':' . $var;
+            $var = $hashType . ':' . $var;
         }
 
         return $var;
@@ -2889,13 +2904,13 @@ class Bootstrap
 
     public function verifyHashPassword ($pass, $userPass)
     {
-        $hashType = Bootstrap::getPasswordHashType();
-        if (Bootstrap::hashPassword($pass, $hashType) == $userPass
-            || $pass === Bootstrap::hashPassword($userPass, $hashType, true)) {
+        $passwordHashConfig = Bootstrap::getPasswordHashConfig();
+        $hashTypeCurrent = $passwordHashConfig['current'];
+        $hashTypePrevious = $passwordHashConfig['previous'];
+        if ((Bootstrap::hashPassword($pass, $hashTypeCurrent) == $userPass) || ($pass === $hashTypeCurrent . ':' . $userPass)) {
             return true;
         }
-        if (Bootstrap::hashPassword($pass, $hashType, false, true) == $userPass
-            ||$pass ===  Bootstrap::hashPassword($userPass, $hashType, true, true)) {
+        if ((Bootstrap::hashPassword($pass, $hashTypePrevious) == $userPass) || ($pass === $hashTypePrevious . ':' . $userPass)) {
             return true;
         }
         return false;

workflow/engine/classes/class.pmFunctions.php

@@ -378,7 +378,7 @@ function evaluateFunction ($aGrid, $sExpresion)
  * @link http://wiki.processmaker.com/index.php/ProcessMaker_Functions#WSLogin.28.29
  *
  * @param string(32) | $user | Username of the user | The username of the user who will login to ProcessMaker. All subsequent actions will be limited to the permissions of that user.
- * @param string(32) | $pass | Password encrypted | The user's password encrypted as an MD5 hash with 'md5:' prepended.
+ * @param string(32) | $pass | Password encrypted | The user's password encrypted as an MD5 or SHA256 hash with '{hashType}:' prepended.
  * @param string(32) | $endpoint="" | URI of the WSDL | The URI (address) of the WSDL definition of the ProcessMaker web services.
  * @return string | $unique ID | Unique Id |The unique ID for the initiated session.
  *
@@ -2849,7 +2849,7 @@ function PMFAddAttachmentToArray($arrayData, $index, $value, $suffix = " Copy({i
  *
  * @name PMFRemoveMask
  * @label PMF Remove Mask
- * 
+ *
  * @param string | $field | Value the field
  * @param string | $separator | Separator of thousands (, or .)
  * @param string | $currency | symbol of currency

workflow/engine/classes/model/CaseScheduler.php

@@ -338,7 +338,7 @@ class CaseScheduler extends BaseCaseScheduler
                 $processId = $aRow["PRO_UID"];
                 $taskId = $aRow["TAS_UID"];
                 $client = new SoapClient( $defaultEndpoint );
-                $params = array ('userid' => $user,'password' => 'md5:' . $pass);
+                $params = array ('userid' => $user,'password' => Bootstrap::getPasswordHashType() . ':' . $pass);
                 $result = $client->__SoapCall( 'login', array ($params) );
                 eprint( " - Logging as user $user............." );
                 if ($result->status_code == 0) {
@@ -500,7 +500,7 @@ class CaseScheduler extends BaseCaseScheduler
                 $processId = $aRow["PRO_UID"];
                 $taskId = $aRow["TAS_UID"];
                 $client = new SoapClient( $defaultEndpoint );
-                $params = array ('userid' => $user,'password' => 'md5:' . $pass);
+                $params = array ('userid' => $user,'password' => Bootstrap::getPasswordHashType() . ':' . $pass);
                 $result = $client->__SoapCall( 'login', array ($params) );
                 eprint( " - Logging as user $user............." );
                 if ($result->status_code == 0) {

workflow/engine/controllers/webEntryProxy.php

@@ -185,7 +185,7 @@ class webEntryProxy extends HttpProxyController
         $template->assign( 'dynaformUid', $sDYNAFORM );
         $template->assign( 'taskUid', $sTASKS );
         $template->assign( 'wsUser', $sWS_USER );
-        $template->assign( 'wsPass', 'md5:' . md5( $sWS_PASS ) );
+        $template->assign( 'wsPass', Bootstrap::hashPassword($sWS_PASS, '', true) );
         $template->assign( 'wsRoundRobin', $sWS_ROUNDROBIN );
 
         if ($sWE_USR == "2") {

workflow/engine/methods/processes/processes_webEntryGenerate.php

@@ -71,7 +71,7 @@ try {
         $template->assign( 'dynaformUid', $sDYNAFORM );
         $template->assign( 'taskUid', $sTASKS );
         $template->assign( 'wsUser', $sWS_USER );
-        $template->assign( 'wsPass', 'md5:' . md5( $sWS_PASS ) );
+        $template->assign( 'wsPass', Bootstrap::hashPassword($sWS_PASS, '', true) );
         $template->assign( 'wsRoundRobin', $sWS_ROUNDROBIN );
 
         if ($sWE_USR == "2") {

workflow/engine/src/ProcessMaker/BusinessModel/ProjectUser.php

@@ -336,7 +336,7 @@ class ProjectUser
 
             $params = array(
                 "userid"   => $username,
-                "password" => "md5:" . md5($password)
+                "password" => Bootstrap::hashPassword($password, '', true)
             );
 
             $response = $client->login($params);

workflow/engine/src/ProcessMaker/BusinessModel/WebEntry.php

@@ -396,7 +396,7 @@ class WebEntry
                     $template->assign("dynaformUid", $dynaFormUid);
                     $template->assign("taskUid", $taskUid);
                     $template->assign("wsUser", $usrUsername);
-                    $template->assign("wsPass", "md5:" . $usrPassword);
+                    $template->assign("wsPass", Bootstrap::getPasswordHashType() . ':' . $usrPassword);
                     $template->assign("wsRoundRobin", $wsRoundRobin);
 
                     if ($webEntryInputDocumentAccess == 0) {