PhpPassword.php

<?php

namespace Drupal\Core\Password;


/**
 * Secure PHP password hashing functions.
 *
 * @see https://www.php.net/manual/en/book.password.php
 */
class PhpPassword implements PasswordInterface {
    
    /**
     * Constructs a new password hashing instance.
     *
     * @param string $algorithm
     *   The hashing algorithm to use. Defaults to PHP default.
     * @param array $options
     *   List of options. Refer to password_hash() for available options.
     *
     * @see https://www.php.net/password_hash
     */
    public function __construct(string $algorithm = PASSWORD_DEFAULT, array $options = []) {
    }
    
    /**
     * {@inheritdoc}
     */
    public function hash($password) {
        // Prevent DoS attacks by refusing to hash large passwords.
        if (strlen($password) > static::PASSWORD_MAX_LENGTH) {
            return FALSE;
        }
        return password_hash($password, $this->algorithm, $this->options);
    }
    
    /**
     * {@inheritdoc}
     */
    public function check($password, $hash) {
        // Prevent DoS attacks by refusing to check large passwords.
        if (strlen($password) > static::PASSWORD_MAX_LENGTH) {
            return FALSE;
        }
        // Newly created accounts may have empty passwords.
        if ($hash === NULL || $hash === '') {
            return FALSE;
        }
        return password_verify($password, $hash);
    }
    
    /**
     * {@inheritdoc}
     */
    public function needsRehash($hash) {
        return password_needs_rehash($hash, $this->algorithm, $this->options);
    }

}