Bug #9286

Should use strcmp not == to compare passwords

Details

Submitted	2006-11-09 13:03 UTC
From	addw at phcomp dot co dot uk
Assigned	aashley
Status	Closed
Package	Auth
PHP Version	Irrelevant
Roadmaps	(Not assigned)

Comments

[2006-11-09 13:03 UTC] addw at phcomp dot co dot uk

Description:
------------
In Auth/Container.php the function verifyPassword() uses == to compare passwords (or the md5/crypted equivalents). This could result in a false equality due to php deciding that they are numeric strings, eg if one is "05" and the other "5".

OK: this is most likely to happen in the 'none' encrypted case, but could theoretically in md5/crypt.

strcmp() should be used to compare these strings.

Test script:
---------------
None, I read the code.

[2006-11-10 01:30 UTC] aashley at php dot net

This bug has been fixed in CVS.

If this was a documentation problem, the fix will appear on pear.php.net by the end of next Sunday (CET).

If this was a problem with the pear.php.net website, the change should be live shortly.

Otherwise, the fix will appear in the package's next release.

Thank you for the report and for helping us make PEAR better.

I used (string)$password1 === (string)$password2 as it is 4 to 5 times as fast as strcmp yet still gives the same results.

[2006-11-12 11:11 UTC] addw at phcomp dot co dot uk

Sorry Adam that doesn't fix it. Execute the following code to see what I mean:

$a = "0001";
$b = "01";
var_dump((string)$a == (string)$b);
var_dump(!strcmp($a, $b));

[2006-11-13 00:54 UTC] aashley at php dot net

which is why I'm not using that code.

try running this:
$a = "0001";
$b = "01";
var_dump((string)$a === (string)$b);
var_dump(!strcmp($a, $b));