wbrawner/server
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge pull request #19095 from nextcloud/backport/19023/stable17

Browse source 
[stable17] expose Argon2 options (as we did for bcrypt)
This commit is contained in:
Roeland Jago Douma 2020-03-05 08:40:04 +01:00 committed by GitHub
commit 53a907f7a8
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 46 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

32
config/config.sample.php
View file

@ -1421,6 +1421,38 @@ $CONFIG = array(
*/
'tempdirectory' => '/tmp/nextcloudtemp',
/**
* Hashing
*
* Nextcloud uses the Argon2 algorithm (available with PHP >= 7.2 if compiled
* with it) to create hashes by its own and exposes its configuration options as
* following. The default depends on the PHP build. More information can be
* found at: https://www.php.net/manual/en/function.password-hash.php
*/
/**
* The allowed maximum memory in KiB to be used by the algorithm for computing a
* hash. The smallest possible value is 8. Values that undershoot the minimum
* will be ignored in favor of the default.
*/
'hashingMemoryCost' => 65536,
/**
* The allowed maximum time in seconds that can be used by the algorithm for
* computing a hash. The value must be an integer, and the minimum value is 1.
* Values that undershoot the minimum will be ignored in favor of the default.
*/
'hashingTimeCost' => 4,
/**
* The allowed number of CPU threads that can be used by the algorithm for
* computing a hash. The value must be an integer, and the minimum value is 1.
* Rationally it does not help to provide a number higher than the available
* threads on the machine. Values that undershoot the minimum will be ignored
* in favor of the default.
*/
'hashingThreads' => 1,
/**
* The hashing cost used by hashes generated by Nextcloud
* Using a higher value requires more time and CPU power to calculate the hashes

14
lib/private/Security/Hasher.php
View file

@ -61,6 +61,20 @@ class Hasher implements IHasher {
public function __construct(IConfig $config) {
$this->config = $config;
if (\defined('PASSWORD_ARGON2I')) {
// password_hash fails, when the minimum values are undershot.
// In this case, ignore and revert to default
if ($this->config->getSystemValueInt('hashingMemoryCost', PASSWORD_ARGON2_DEFAULT_MEMORY_COST) >= 8) {
$this->options['memory_cost'] = $this->config->getSystemValueInt('hashingMemoryCost', PASSWORD_ARGON2_DEFAULT_MEMORY_COST);
}
if ($this->config->getSystemValueInt('hashingTimeCost', PASSWORD_ARGON2_DEFAULT_MEMORY_COST) >= 1) {
$this->options['time_cost'] = $this->config->getSystemValueInt('hashingTimeCost', PASSWORD_ARGON2_DEFAULT_TIME_COST);
}
if ($this->config->getSystemValueInt('hashingThreads', PASSWORD_ARGON2_DEFAULT_MEMORY_COST) >= 1) {
$this->options['threads'] = $this->config->getSystemValueInt('hashingThreads', PASSWORD_ARGON2_DEFAULT_THREADS);
}
}
$hashingCost = $this->config->getSystemValue('hashingCost', null);
if(!\is_null($hashingCost)) {
$this->options['cost'] = $hashingCost;