From e3dc2b22fd8c9f1a2a9b559cbfd11a3141203bd4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Fromme?= Date: Sat, 21 Oct 2023 10:04:59 +0200 Subject: [PATCH] Task: Hash user password before storing in session --- src/BusProNet/ApiClient.php | 6 +++--- src/Security/BpnAuthenticator.php | 6 +++++- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/src/BusProNet/ApiClient.php b/src/BusProNet/ApiClient.php index c485046..93a27b2 100644 --- a/src/BusProNet/ApiClient.php +++ b/src/BusProNet/ApiClient.php @@ -44,7 +44,7 @@ class ApiClient 'satz' => ['@typ' => static::TYPE_CUSTOMER_DATA], 'art' => 'Adressdaten', 'email' => $email, - 'passwort' => md5($password), + 'passwort' => $password, ], ]; @@ -67,7 +67,7 @@ class ApiClient 'satz' => ['@typ' => static::TYPE_CUSTOMER_DATA], 'art' => 'Adressdaten_Ändern', 'email' => $user->getEmail(), - 'passwort' => md5($password), + 'passwort' => $password, 'idadresse' => $user->getBusProAddressId(), 'adressdaten' => $teamer->toPayload(), ], @@ -106,7 +106,7 @@ class ApiClient 'satz' => ['@typ' => static::TYPE_CUSTOMER_DATA], 'art' => 'SelektionCRM', 'email' => $email, - 'passwort' => md5($password), + 'passwort' => $password, ], ]; diff --git a/src/Security/BpnAuthenticator.php b/src/Security/BpnAuthenticator.php index 35a47b0..61f2988 100644 --- a/src/Security/BpnAuthenticator.php +++ b/src/Security/BpnAuthenticator.php @@ -46,7 +46,11 @@ class BpnAuthenticator extends AbstractLoginFormAuthenticator implements Authent public function authenticate(Request $request): Passport { $email = trim($request->request->get('_username', '')); - $password = trim($request->request->get('_password', '')); + $passwordPlain = trim($request->request->get('_password', '')); + + // Very lame hashing applied here as required by BPN + $password = md5($passwordPlain); + $csrfToken = $request->request->get('_csrf_token', ''); return new SelfValidatingPassport(