diff --git a/.github/workflows/typos.toml b/.github/workflows/typos.toml index a1929444ab8a4..b1903976406b4 100644 --- a/.github/workflows/typos.toml +++ b/.github/workflows/typos.toml @@ -23,7 +23,7 @@ childs="childs" # Used in config-filters.es6.js and language string cose="cose" # Webauthn COSE algorithm credate="credate" # Selector in queries cript="cript" # Used in regex for htaccess.txt and web.config.txt -crypted="crypted" # Used in MD5Handler +crypted="crypted" # Used in User.php datas="datas" # Used in showon.es6.js deactive="deactive" # Used in searchtools.es6.js exept="exept" # Used in El.php Greek language stemmer diff --git a/administrator/components/com_admin/script.php b/administrator/components/com_admin/script.php index 14502f8998d09..55d9aae012757 100644 --- a/administrator/components/com_admin/script.php +++ b/administrator/components/com_admin/script.php @@ -456,6 +456,7 @@ public function deleteUnexistingFiles($dryRun = false, $suppressOutput = false) '/administrator/components/com_admin/sql/updates/postgresql/6.1.0-2026-03-07.sql', '/administrator/components/com_admin/sql/updates/postgresql/6.1.0-2026-03-10.sql', '/administrator/components/com_admin/sql/updates/postgresql/6.1.0-2026-03-13.sql', + '/libraries/src/Authentication/Password/MD5Handler.php', '/libraries/src/Encrypt/AES/Mcrypt.php', ]; diff --git a/libraries/src/Authentication/Password/MD5Handler.php b/libraries/src/Authentication/Password/MD5Handler.php deleted file mode 100644 index 750971807c44b..0000000000000 --- a/libraries/src/Authentication/Password/MD5Handler.php +++ /dev/null @@ -1,95 +0,0 @@ - - * @license GNU General Public License version 2 or later; see LICENSE.txt - */ - -namespace Joomla\CMS\Authentication\Password; - -use Joomla\Authentication\Password\HandlerInterface; -use Joomla\CMS\User\UserHelper; - -// phpcs:disable PSR1.Files.SideEffects -\defined('_JEXEC') or die; -// phpcs:enable PSR1.Files.SideEffects - -/** - * Password handler for MD5 hashed passwords - * - * @since 4.0.0 - * - * @deprecated 4.0 will be removed in 7.0 - * Support for MD5 hashed passwords will be removed without replacement - */ -class MD5Handler implements HandlerInterface, CheckIfRehashNeededHandlerInterface -{ - /** - * Check if the password requires rehashing - * - * @param string $hash The password hash to check - * - * @return boolean - * - * @since 4.0.0 - */ - public function checkIfRehashNeeded(string $hash): bool - { - return true; - } - - /** - * Generate a hash for a plaintext password - * - * @param string $plaintext The plaintext password to validate - * @param array $options Options for the hashing operation - * - * @return string - * - * @since 4.0.0 - */ - public function hashPassword($plaintext, array $options = []) - { - $salt = UserHelper::genRandomPassword(32); - $crypted = md5($plaintext . $salt); - - return $crypted . ':' . $salt; - } - - /** - * Check that the password handler is supported in this environment - * - * @return boolean - * - * @since 4.0.0 - */ - public static function isSupported() - { - return true; - } - - /** - * Validate a password - * - * @param string $plaintext The plain text password to validate - * @param string $hashed The password hash to validate against - * - * @return boolean - * - * @since 4.0.0 - */ - public function validatePassword($plaintext, $hashed) - { - // Check the password - $parts = explode(':', $hashed); - $salt = @$parts[1]; - - // Compile the hash to compare - // If the salt is empty AND there is a ':' in the original hash, we must append ':' at the end - $testcrypt = md5($plaintext . $salt) . ($salt ? ':' . $salt : (str_contains($hashed, ':') ? ':' : '')); - - return hash_equals($hashed, $testcrypt); - } -} diff --git a/libraries/src/Service/Provider/Authentication.php b/libraries/src/Service/Provider/Authentication.php index 3caa49c0d24a5..3da8e71835a5c 100644 --- a/libraries/src/Service/Provider/Authentication.php +++ b/libraries/src/Service/Provider/Authentication.php @@ -16,7 +16,6 @@ use Joomla\CMS\Authentication\Password\Argon2iHandler; use Joomla\CMS\Authentication\Password\BCryptHandler; use Joomla\CMS\Authentication\Password\ChainedHandler; -use Joomla\CMS\Authentication\Password\MD5Handler; use Joomla\DI\Container; use Joomla\DI\ServiceProviderInterface; @@ -79,8 +78,6 @@ function (Container $container) { $handler->addHandler($container->get(Argon2idHandler::class)); } - $handler->addHandler($container->get(MD5Handler::class)); - return $handler; }, true @@ -97,23 +94,5 @@ function (Container $container) { }, true ); - - $container->alias('password.handler.md5', MD5Handler::class) - ->share( - MD5Handler::class, - function (Container $container) { - @trigger_error( - \sprintf( - 'The "%1$s" class service is deprecated, use the "%2$s" service for the active password handler instead.', - MD5Handler::class, - 'password.handler.default' - ), - E_USER_DEPRECATED - ); - - return new MD5Handler(); - }, - true - ); } } diff --git a/libraries/src/User/User.php b/libraries/src/User/User.php index 2057efe7b3563..47a995d12f4b3 100644 --- a/libraries/src/User/User.php +++ b/libraries/src/User/User.php @@ -78,7 +78,7 @@ class User public $email = null; /** - * MD5 encrypted password + * Hashed password * * @var string * @since 1.7.0 diff --git a/libraries/src/User/UserHelper.php b/libraries/src/User/UserHelper.php index 98cbc59cd7db3..30a665f1a123f 100644 --- a/libraries/src/User/UserHelper.php +++ b/libraries/src/User/UserHelper.php @@ -15,7 +15,6 @@ use Joomla\CMS\Access\Access; use Joomla\CMS\Authentication\Password\ChainedHandler; use Joomla\CMS\Authentication\Password\CheckIfRehashNeededHandlerInterface; -use Joomla\CMS\Authentication\Password\MD5Handler; use Joomla\CMS\Event\Model\PrepareDataEvent; use Joomla\CMS\Factory; use Joomla\CMS\Language\Text; @@ -71,17 +70,6 @@ abstract class UserHelper */ public const HASH_BCRYPT = '2y'; - /** - * Constant defining the MD5 password algorithm for use with password hashes - * - * @var string - * @since 4.0.0 - * - * @deprecated 4.0 will be removed in 7.0 - * Support for MD5 hashed passwords will be removed use any of the other hashing methods - */ - public const HASH_MD5 = 'md5'; - /** * Mapping array for the algorithm handler * @@ -92,7 +80,6 @@ abstract class UserHelper self::HASH_ARGON2I => Argon2iHandler::class, self::HASH_ARGON2ID => Argon2idHandler::class, self::HASH_BCRYPT => BCryptHandler::class, - self::HASH_MD5 => MD5Handler::class, ]; /** diff --git a/phpstan-baseline.neon b/phpstan-baseline.neon index 19b608b070a0a..4aafb4fccf0a8 100644 --- a/phpstan-baseline.neon +++ b/phpstan-baseline.neon @@ -11765,26 +11765,6 @@ parameters: count: 1 path: libraries/src/Serializer/JoomlaSerializer.php - - - message: ''' - #^Access to constant on deprecated class Joomla\\CMS\\Authentication\\Password\\MD5Handler\: - 4\.0 will be removed in 7\.0 - Support for MD5 hashed passwords will be removed without replacement$# - ''' - identifier: classConstant.deprecatedClass - count: 4 - path: libraries/src/Service/Provider/Authentication.php - - - - message: ''' - #^Instantiation of deprecated class Joomla\\CMS\\Authentication\\Password\\MD5Handler\: - 4\.0 will be removed in 7\.0 - Support for MD5 hashed passwords will be removed without replacement$# - ''' - identifier: new.deprecatedClass - count: 1 - path: libraries/src/Service/Provider/Authentication.php - - message: ''' #^Call to deprecated method register\(\) of class JLoader\: @@ -12490,16 +12470,6 @@ parameters: count: 1 path: libraries/src/User/User.php - - - message: ''' - #^Access to constant on deprecated class Joomla\\CMS\\Authentication\\Password\\MD5Handler\: - 4\.0 will be removed in 7\.0 - Support for MD5 hashed passwords will be removed without replacement$# - ''' - identifier: classConstant.deprecatedClass - count: 1 - path: libraries/src/User/UserHelper.php - - message: ''' #^Call to deprecated method getDbo\(\) of class Joomla\\CMS\\Factory\: @@ -12546,16 +12516,6 @@ parameters: count: 6 path: libraries/src/User/UserHelper.php - - - message: ''' - #^Fetching deprecated class constant HASH_MD5 of class Joomla\\CMS\\User\\UserHelper\: - 4\.0 will be removed in 7\.0 - Support for MD5 hashed passwords will be removed use any of the other hashing methods$# - ''' - identifier: classConstant.deprecated - count: 1 - path: libraries/src/User/UserHelper.php - - message: ''' #^Call to deprecated method getUser\(\) of class Joomla\\CMS\\Factory\: