[BUGFIX] Only use SaltedHashingMethods marked as available 27/57627/2
authorOliver Hader <oliver@typo3.org>
Thu, 19 Jul 2018 07:23:16 +0000 (09:23 +0200)
committerStefan Neufeind <typo3.neufeind@speedpartner.de>
Thu, 19 Jul 2018 07:26:27 +0000 (09:26 +0200)
When determining the SaltedHashingMethod of a salted hash check only
SaltedHashingMethods which are marked as available.

Resolves: #85526
Releases: master, 8.7
Change-Id: I72ca88ce35c891dc149d0628543d30b6c4122407
Reviewed-on: https://review.typo3.org/57627
Reviewed-by: Stefan Neufeind <typo3.neufeind@speedpartner.de>
Tested-by: Stefan Neufeind <typo3.neufeind@speedpartner.de>
typo3/sysext/saltedpasswords/Classes/Salt/SaltFactory.php

index c37c921..9100301 100644 (file)
@@ -122,7 +122,7 @@ class SaltFactory
         $methodFound = false;
         foreach ($registeredMethods as $method) {
             $objectInstance = \TYPO3\CMS\Core\Utility\GeneralUtility::getUserObj($method);
-            if ($objectInstance instanceof SaltInterface) {
+            if ($objectInstance instanceof SaltInterface && $objectInstance->isAvailable()) {
                 $methodFound = $objectInstance->isValidSaltedPW($saltedHash);
                 if ($methodFound) {
                     self::$instance = $objectInstance;