diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3d949f0..3d7622f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
## [Unreleased]
### Added
- Options for Courier authlib authentication: courier_md5, courier_md5raw, courier_sha1, courier_sha256
+- crypt_type 'drupal' for Drupal 7 authentication
## [3.1.0] - 2018-02-06
### Added
diff --git a/lib/drupal.php b/lib/drupal.php
new file mode 100644
index 0000000..4c7e0a4
--- /dev/null
+++ b/lib/drupal.php
@@ -0,0 +1,321 @@
+> 6) & 0x3f];
+ if ($i++ >= $count) {
+ break;
+ }
+ if ($i < $count) {
+ $value |= ord($input[$i]) << 16;
+ }
+ $output .= $itoa64[($value >> 12) & 0x3f];
+ if ($i++ >= $count) {
+ break;
+ }
+ $output .= $itoa64[($value >> 18) & 0x3f];
+ } while ($i < $count);
+
+ return $output;
+}
+/**
+ * Returns a string of highly randomized bytes (over the full 8-bit range).
+ *
+ * This function is better than simply calling mt_rand() or any other built-in
+ * PHP function because it can return a long string of bytes (compared to < 4
+ * bytes normally from mt_rand()) and uses the best available pseudo-random
+ * source.
+ *
+ * @param $count
+ * The number of characters (bytes) to return in the string.
+ */
+
+ function _random_bytes($count) {
+ // $random_state does not use static as it stores random bytes.
+ static $random_state, $bytes, $has_openssl;
+
+ $missing_bytes = $count - strlen($bytes);
+
+ if ($missing_bytes > 0) {
+ // PHP versions prior 5.3.4 experienced openssl_random_pseudo_bytes()
+ // locking on Windows and rendered it unusable.
+ if (!isset($has_openssl)) {
+ $has_openssl = version_compare(PHP_VERSION, '5.3.4', '>=') && function_exists('openssl_random_pseudo_bytes');
+ }
+
+ // openssl_random_pseudo_bytes() will find entropy in a system-dependent
+ // way.
+ if ($has_openssl) {
+ $bytes .= openssl_random_pseudo_bytes($missing_bytes);
+ }
+
+ // Else, read directly from /dev/urandom, which is available on many *nix
+ // systems and is considered cryptographically secure.
+ elseif ($fh = @fopen('/dev/urandom', 'rb')) {
+ // PHP only performs buffered reads, so in reality it will always read
+ // at least 4096 bytes. Thus, it costs nothing extra to read and store
+ // that much so as to speed any additional invocations.
+ $bytes .= fread($fh, max(4096, $missing_bytes));
+ fclose($fh);
+ }
+
+ // If we couldn't get enough entropy, this simple hash-based PRNG will
+ // generate a good set of pseudo-random bytes on any system.
+ // Note that it may be important that our $random_state is passed
+ // through hash() prior to being rolled into $output, that the two hash()
+ // invocations are different, and that the extra input into the first one -
+ // the microtime() - is prepended rather than appended. This is to avoid
+ // directly leaking $random_state via the $output stream, which could
+ // allow for trivial prediction of further "random" numbers.
+ if (strlen($bytes) < $count) {
+ // Initialize on the first call. The contents of $_SERVER includes a mix of
+ // user-specific and system information that varies a little with each page.
+ if (!isset($random_state)) {
+ $random_state = print_r($_SERVER, TRUE);
+ if (function_exists('getmypid')) {
+ // Further initialize with the somewhat random PHP process ID.
+ $random_state .= getmypid();
+ }
+ $bytes = '';
+ }
+
+ do {
+ $random_state = hash('sha256', microtime() . mt_rand() . $random_state);
+ $bytes .= hash('sha256', mt_rand() . $random_state, TRUE);
+ }
+ while (strlen($bytes) < $count);
+ }
+ }
+ $output = substr($bytes, 0, $count);
+ $bytes = substr($bytes, $count);
+ return $output;
+}
+
+/**
+ * Generates a random base 64-encoded salt prefixed with settings for the hash.
+ *
+ * Proper use of salts may defeat a number of attacks, including:
+ * - The ability to try candidate passwords against multiple hashes at once.
+ * - The ability to use pre-hashed lists of candidate passwords.
+ * - The ability to determine whether two users have the same (or different)
+ * password without actually having to guess one of the passwords.
+ *
+ * @param $count_log2
+ * Integer that determines the number of iterations used in the hashing
+ * process. A larger value is more secure, but takes more time to complete.
+ *
+ * @return
+ * A 12 character string containing the iteration count and a random salt.
+ */
+function _password_generate_salt($count_log2) {
+ $output = '$S$';
+ // Ensure that $count_log2 is within set bounds.
+ $count_log2 = _password_enforce_log2_boundaries($count_log2);
+ // We encode the final log2 iteration count in base 64.
+ $itoa64 = _password_itoa64();
+ $output .= $itoa64[$count_log2];
+ // 6 bytes is the standard salt for a portable phpass hash.
+ $output .= _password_base64_encode(_random_bytes(6), 6);
+ return $output;
+}
+
+/**
+ * Ensures that $count_log2 is within set bounds.
+ *
+ * @param $count_log2
+ * Integer that determines the number of iterations used in the hashing
+ * process. A larger value is more secure, but takes more time to complete.
+ *
+ * @return
+ * Integer within set bounds that is closest to $count_log2.
+ */
+function _password_enforce_log2_boundaries($count_log2) {
+ if ($count_log2 < MIN_HASH_COUNT) {
+ return MIN_HASH_COUNT;
+ }
+ elseif ($count_log2 > MAX_HASH_COUNT) {
+ return MAX_HASH_COUNT;
+ }
+
+ return (int) $count_log2;
+}
+
+/**
+ * Hash a password using a secure stretched hash.
+ *
+ * By using a salt and repeated hashing the password is "stretched". Its
+ * security is increased because it becomes much more computationally costly
+ * for an attacker to try to break the hash by brute-force computation of the
+ * hashes of a large number of plain-text words or strings to find a match.
+ *
+ * @param $algo
+ * The string name of a hashing algorithm usable by hash(), like 'sha256'.
+ * @param $password
+ * Plain-text password up to 512 bytes (128 to 512 UTF-8 characters) to hash.
+ * @param $setting
+ * An existing hash or the output of _password_generate_salt(). Must be
+ * at least 12 characters (the settings and salt).
+ *
+ * @return
+ * A string containing the hashed password (and salt) or FALSE on failure.
+ * The return string will be truncated at DRUPAL_HASH_LENGTH characters max.
+ */
+function _password_crypt($algo, $password, $setting) {
+ // Prevent DoS attacks by refusing to hash large passwords.
+ if (strlen($password) > 512) {
+ return FALSE;
+ }
+ // The first 12 characters of an existing hash are its setting string.
+ $setting = substr($setting, 0, 12);
+
+ if ($setting[0] != '$' || $setting[2] != '$') {
+ return FALSE;
+ }
+ $count_log2 = _password_get_count_log2($setting);
+ // Hashes may be imported from elsewhere, so we allow != DRUPAL_HASH_COUNT
+ if ($count_log2 < MIN_HASH_COUNT || $count_log2 > MAX_HASH_COUNT) {
+ return FALSE;
+ }
+ $salt = substr($setting, 4, 8);
+ // Hashes must have an 8 character salt.
+ if (strlen($salt) != 8) {
+ return FALSE;
+ }
+
+ // Convert the base 2 logarithm into an integer.
+ $count = 1 << $count_log2;
+
+ // We rely on the hash() function being available in PHP 5.2+.
+ $hash = hash($algo, $salt . $password, TRUE);
+ do {
+ $hash = hash($algo, $hash . $password, TRUE);
+ } while (--$count);
+
+ $len = strlen($hash);
+ $output = $setting . _password_base64_encode($hash, $len);
+ // _password_base64_encode() of a 16 byte MD5 will always be 22 characters.
+ // _password_base64_encode() of a 64 byte sha512 will always be 86 characters.
+ $expected = 12 + ceil((8 * $len) / 6);
+ return (strlen($output) == $expected) ? substr($output, 0, HASH_LENGTH) : FALSE;
+}
+
+/**
+ * Parse the log2 iteration count from a stored hash or setting string.
+ */
+function _password_get_count_log2($setting) {
+ $itoa64 = _password_itoa64();
+ return strpos($itoa64, $setting[3]);
+}
+
+/**
+ * Hash a password using a secure hash.
+ *
+ * @param $password
+ * A plain-text password.
+ * @param $count_log2
+ * Optional integer to specify the iteration count. Generally used only during
+ * mass operations where a value less than the default is needed for speed.
+ *
+ * @return
+ * A string containing the hashed password (and a salt), or FALSE on failure.
+ */
+function user_hash_password($password, $count_log2 = 0) {
+ if (empty($count_log2)) {
+ // Use the standard iteration count.
+ $count_log2 = variable_get('password_count_log2', DRUPAL_HASH_COUNT);
+ }
+ return _password_crypt('sha512', $password, _password_generate_salt($count_log2));
+}
+
+/**
+ * Check whether a plain text password matches a stored hashed password.
+ *
+ * @param $password
+ * A plain-text password
+ * @param $hashpass
+ *
+ * @return
+ * TRUE or FALSE.
+ */
+function user_check_password($password, $hashpass) {
+ $stored_hash = $hashpass;
+ $type = substr($stored_hash, 0, 3);
+ switch ($type) {
+ case '$S$':
+ // A normal Drupal 7 password using sha512.
+ $hash = _password_crypt('sha512', $password, $stored_hash);
+ break;
+ case '$H$':
+ // phpBB3 uses "$H$" for the same thing as "$P$".
+ case '$P$':
+ // A phpass password generated using md5. This is an
+ // imported password or from an earlier Drupal version.
+ $hash = _password_crypt('md5', $password, $stored_hash);
+ break;
+ default:
+ return FALSE;
+ }
+ return ($hash && $stored_hash == $hash);
+}
\ No newline at end of file
diff --git a/lib/user_sql.php b/lib/user_sql.php
index 1dc69b5..936dfbb 100644
--- a/lib/user_sql.php
+++ b/lib/user_sql.php
@@ -308,7 +308,13 @@ class OC_USER_SQL extends BackendUtility implements \OCP\IUserBackend,
return false;
}
$old_password = $row[$this -> settings['col_password']];
- if($this -> settings['set_crypt_type'] === 'joomla2')
+
+ // Added and disabled updating passwords for Drupal 7 WD 2018-01-04
+ if($this -> settings['set_crypt_type'] === 'drupal')
+ {
+ return false;
+ }
+ elseif($this -> settings['set_crypt_type'] === 'joomla2')
{
if(!class_exists('\PasswordHash'))
require_once('PasswordHash.php');
@@ -415,9 +421,16 @@ class OC_USER_SQL extends BackendUtility implements \OCP\IUserBackend,
Util::writeLog('OC_USER_SQL', "Encrypting and checking password",
Util::DEBUG);
+ // Added handling for Drupal 7 passwords WD 2018-01-04
+ if($this -> settings['set_crypt_type'] === 'drupal')
+ {
+ if(!function_exists('user_check_password'))
+ require_once('drupal.php');
+ $ret = user_check_password($password, $db_pass);
+ }
// Joomla 2.5.18 switched to phPass, which doesn't play nice with the
// way we check passwords
- if($this -> settings['set_crypt_type'] === 'joomla2')
+ elseif($this -> settings['set_crypt_type'] === 'joomla2')
{
if(!class_exists('\PasswordHash'))
require_once('PasswordHash.php');
diff --git a/templates/admin.php b/templates/admin.php
index 8a48095..4820559 100644
--- a/templates/admin.php
+++ b/templates/admin.php
@@ -70,7 +70,7 @@ $cfgClass = 'section';