Merge pull request #1498 from benedmunds/benedmunds-remove-admin-hashing

Remove admin specific hash params, use the same params for all users

Author: benedmunds

config/ion_auth.php

@@ -58,9 +58,9 @@
  | -------------------------------------------------------------------------
  | Bcrypt is available in PHP 5.3+
  | Argon2 is available in PHP 7.2
+ | Argon2id is available in PHP 7.3
  |
- | Argon2 is recommended by expert (it is actually the winner of the Password Hashing Competition
- | for more information see https://password-hashing.net). So if you can (PHP 7.2), go for it.
+ | Bcrypt is the current PHP language default.
  |
  | Bcrypt specific:
  | 		bcrypt_default_cost settings:  This defines how strong the encryption will be.
@@ -73,8 +73,6 @@
  | 		With bcrypt, an example hash of "password" is:
  | 		$2y$08$200Z6ZZbp3RAEXoaWcMA6uJOFicwNZaqk4oDhqTUiFXFe63MG.Daa
  |
- |		A specific parameter bcrypt_admin_cost is available for user in admin group.
- |		It is recommended to have a stronger hashing for administrators.
  |
  | Argon2 specific:
  | 		argon2_default_params settings:  This is an array containing the options for the Argon2 algorithm.
@@ -95,26 +93,20 @@
  | 		With argon2, an example hash of "password" is:
  | 		$argon2i$v=19$m=1024,t=2,p=2$VEFSSU4wSzh3cllVdE1JZQ$PDeks/7JoKekQrJa9HlfkXIk8dAeZXOzUxLBwNFbZ44
  |
- |		A specific parameter argon2_admin_params is available for user in admin group.
- |		It is recommended to have a stronger hashing for administrators.
  |
  | For more information, check the password_hash function help: http://php.net/manual/en/function.password-hash.php
  |
  */
-$config['hash_method']				= 'bcrypt';	// bcrypt or argon2
-$config['bcrypt_default_cost']		= 10;		// Set cost according to your server benchmark - but no lower than 10 (default PHP value)
-$config['bcrypt_admin_cost']		= 12;		// Cost for user in admin group
+$config['hash_method']			= 'bcrypt';	// bcrypt, argon2, or argon2id
+$config['bcrypt_default_cost']		= defined('PASSWORD_BCRYPT_DEFAULT_COST') ? PASSWORD_BCRYPT_DEFAULT_COST : 10;		// Set cost according to your server benchmark - but no lower than 10 (default PHP value)
 $config['argon2_default_params']	= [
-	'memory_cost'	=> 1 << 12,	// 4MB
-	'time_cost'		=> 2,
-	'threads'		=> 2
-];
-$config['argon2_admin_params']		= [
-	'memory_cost'	=> 1 << 14,	// 16MB
-	'time_cost'		=> 4,
-	'threads'		=> 2
+	'memory_cost'	=> defined('PASSWORD_ARGON2_DEFAULT_MEMORY_COST') ? PASSWORD_ARGON2_DEFAULT_MEMORY_COST : 1 << 12,
+	'time_cost'	=> defined('PASSWORD_ARGON2_DEFAULT_TIME_COST') ? PASSWORD_ARGON2_DEFAULT_TIME_COST : 2,
+	'threads'	=> defined('PASSWORD_ARGON2_DEFAULT_THREADS') ? PASSWORD_ARGON2_DEFAULT_THREADS : 2
 ];
 
+// NOTE - the admin specific hashing config fields are no longer used, all users share the same hashing params now
+
 /*
  | -------------------------------------------------------------------------
  | Authentication options.

models/Ion_auth_model.php

@@ -280,7 +280,7 @@ public function db()
 	 * Hashes the password to be stored in the database.
 	 *
 	 * @param string $password
-	 * @param string $identity
+	 * @param string Deprecated, identity is no longer used when hashing passwords
 	 *
 	 * @return false|string
 	 * @author Mathew
@@ -297,7 +297,7 @@ public function hash_password($password, $identity = NULL)
 		}
 
 		$algo = $this->_get_hash_algo();
-		$params = $this->_get_hash_parameters($identity);
+		$params = $this->_get_hash_parameters();
 
 		if ($algo !== FALSE && $params !== FALSE)
 		{
@@ -357,7 +357,7 @@ public function verify_password($password, $hash_password_db, $identity = NULL)
 	public function rehash_password_if_needed($hash, $identity, $password)
 	{
 		$algo = $this->_get_hash_algo();
-		$params = $this->_get_hash_parameters($identity);
+		$params = $this->_get_hash_parameters();
 
 		if ($algo !== FALSE && $params !== FALSE)
 		{
@@ -2605,37 +2605,24 @@ protected function _random_token($result_length = 32)
 
 	/** Retrieve hash parameter according to options
 	 *
-	 * @param string	$identity
+	 * @param string Deprecated, identity is no longer used when hashing passwords
 	 *
 	 * @return array|bool
 	 */
 	protected function _get_hash_parameters($identity = NULL)
 	{
-		// Check if user is administrator or not
-		$is_admin = FALSE;
-		if ($identity)
-		{
-			$user_id = $this->get_user_id_from_identity($identity);
-			if ($user_id && $this->in_group($this->config->item('admin_group', 'ion_auth'), $user_id))
-			{
-				$is_admin = TRUE;
-			}
-		}
-
 		$params = FALSE;
 		switch ($this->hash_method)
 		{
 			case 'bcrypt':
 				$params = [
-					'cost' => $is_admin ? $this->config->item('bcrypt_admin_cost', 'ion_auth')
-										: $this->config->item('bcrypt_default_cost', 'ion_auth')
+					'cost' => $this->config->item('bcrypt_default_cost', 'ion_auth')
 				];
 				break;
 
 			case 'argon2':
 			case 'argon2id':
-				$params = $is_admin ? $this->config->item('argon2_admin_params', 'ion_auth')
-									: $this->config->item('argon2_default_params', 'ion_auth');
+				$params = $this->config->item('argon2_default_params', 'ion_auth');
 				break;
 
 			default: