common/components/Security.php - dev - v.bolshakov/AIEcosystem-Testing

common/components/Security.php
101 строка3 KB
Developer
Initial commit
03 авг 2026, 17:43
03 авг 2026, 17:437433917
<?php
/**
 * Created by PhpStorm.
 * User: alexander
 * Date: 21.01.19
 * Time: 12:38
 */

namespace common\components;


use Yii;
use yii\base\InvalidArgumentException;

class Security extends \yii\base\Security
{


    /**
     * Generates a secure hash from a password and a random salt.
     *
     * The generated hash can be stored in database.
     * Later when a password needs to be validated, the hash can be fetched and passed
     * to [[validatePassword()]]. For example,
     *
     * ```php
     * // generates the hash (usually done during user registration or when the password is changed)
     * $hash = Yii::$app->getSecurity()->generatePasswordHash($password);
     * // ...save $hash in database...
     *
     * // during login, validate if the password entered is correct using $hash fetched from database
     * if (Yii::$app->getSecurity()->validatePassword($password, $hash)) {
     *     // password is good
     * } else {
     *     // password is bad
     * }
     * ```
     *
     * @param string $password The password to be hashed.
     * @param int $cost Cost parameter used by the Blowfish hash algorithm.
     * The higher the value of cost,
     * the longer it takes to generate the hash and to verify a password against it. Higher cost
     * therefore slows down a brute-force attack. For best protection against brute-force attacks,
     * set it to the highest value that is tolerable on production servers. The time taken to
     * compute the hash doubles for every increment by one of $cost.
     * @return string The password hash string. When [[passwordHashStrategy]] is set to 'crypt',
     * the output is always 60 ASCII characters, when set to 'password_hash' the output length
     * might increase in future versions of PHP (http://php.net/manual/en/function.password-hash.php)
     * @throws Exception on bad password parameter or cost parameter.
     * @see validatePassword()
     */
    public function generatePasswordHash($password, $cost = null)
    {
        return $this->generateErpPasswordHash($password);
    }

    /**
     * Verifies a password against a hash.
     * @param string $password The password to verify.
     * @param string $hash The hash to verify the password against.
     * @return bool whether the password is correct.
     * @throws InvalidArgumentException on bad password/hash parameters or if crypt() with Blowfish hash is not available.
     * @see generatePasswordHash()
     */
    public function validatePassword($password, $hash)
    {
        if (!is_string($password) || $password === '') {
            throw new InvalidArgumentException('Password must be a string and cannot be empty.');
        }

        if (Yii::$app->params['checkBothAuthAlgo']) {
            return password_verify($password, $hash) || $this->validateErpPasswordHash($password, $hash);
        } else {
            return $this->validateErpPasswordHash($password, $hash);
        }

    }


    /**
     * generate erp hash password
     * @param $password
     * @return string
     */
    public function generateErpPasswordHash($password)
    {
        return strtoupper(sha1($password));
    }


    /**
     * validate erp hash password
     * @param $password
     * @param $hash
     * @return boolean
     */
    public function validateErpPasswordHash($password, $hash)
    {
        return $this->compareString($this->generateErpPasswordHash($password), $hash);
    }
}