Commit 432de62d authored by Patrick Schmalstig's avatar Patrick Schmalstig
Browse files

Fixed MANTIS-5623 (Installer does not actually determine a good ratchet... 

Fixed MANTIS-5623 (Installer does not actually determine a good ratchet default despite language string saying so)
parent c98cdc49

install.php

+11 −0
Original line number Diff line number Diff line
@@ -2272,6 +2272,16 @@ function step_6() 
    require_code('database_action');

    require_code('menus2');

    require_code('config');

    require_code('crypt');



    // Determine a default ratchet (we must set this before installing cns as we want the ratchet to apply to our default accounts)

    $cost = calculate_reasonable_ratchet();

    if ($cost !== null) {

        require_code('config2');

        set_option('crypt_ratchet', strval($cost));

        $log->attach(do_template('INSTALLER_DONE_SOMETHING', array('_GUID' => '83dcbisducdiscubsdcaufbvkdhyfsgvuy', 'SOMETHING' => do_lang_tempcode('SET_DEFAULT_CRYPT_RATCHET', escape_html(integer_format($cost))))));

    }



    include_cns();



    require_code('cns_install');
@@ -2316,6 +2326,7 @@ function big_installation_common() 
    require_code('database_action');

    require_code('menus2');

    require_code('config');

    require_code('config2');

    require_code('zones2');

}

lang/EN/installer.ini

+1 −0
Original line number Diff line number Diff line
@@ -26,6 +26,7 @@ INSTALLED_CNS=Installed Conversr (the Composr forum) 
INSTALLED_MODULE=Installed module <kbd>{1}</kbd>

INSTALLED_BLOCK=Installed block <kbd>{1}</kbd>

INSTALLED_ADDON=Installed <kbd>{1}</kbd>

SET_DEFAULT_CRYPT_RATCHET=Set the default password cryptographic ratchet to {1}

CREATED_CUSTOM_PROFILE_FIELDS=Created custom profile fields

CHMOD_PASS=CHMODing worked

CHMOD_FAIL=CHMODing failed. This may be because the server might be running Microsoft Windows. If your server is setup to allow write access by default, this is fine. Otherwise you will need to perform CHMODing according to the installation tutorial.

sources/crypt.php

+26 −0
Original line number Diff line number Diff line
@@ -326,3 +326,29 @@ function get_secure_random_number() 
    }

    return $code;

}



/**

 * Calculate a reasonable cryptographic ratchet based on the server's CPU speed.

 *

 * @param  float $target_time The ratchet should not exceed this amount of time in seconds when calculating

 * @param  int $minimum_cost The minimum allowed ratchet

 * @return ?int The suggested ratchet to use (null: password_hash is not supported)

 */

function calculate_reasonable_ratchet($target_time = 0.1, $minimum_cost = 4)

{

    if (!function_exists('password_hash')) {

        return null;

    }



    $cost = ($minimum_cost - 1);



    do {

        $cost++;

        $start = microtime(true);

        password_hash('test', PASSWORD_BCRYPT, ['cost' => $cost]);

        $end = microtime(true);

        $elapsed_time = $end - $start;

    } while ($elapsed_time < $target_time);



    return ($cost - 1); // We don't want to use the cost that exceeded our target time; use the one below it.

}

sources_custom/string_scan.php

+1 −0
Original line number Diff line number Diff line
@@ -4861,6 +4861,7 @@ function string_scan($lang, $do_guessing = false, $only_exists = true) 
        INSTALLED_ADDON

        INSTALLED_BLOCK

        INSTALLED_CNS

        SET_DEFAULT_CRYPT_RATCHET

        DROPPED_TABLES

        DELETED_ATTACHMENTS

        INSTALLED_MODULE