From b04e98170e49dd3dc35bc3df1af0cfe92fb6b663 Mon Sep 17 00:00:00 2001
From: Andreas Boehler <andreas@aboehler.at>
Date: Tue, 18 Nov 2014 21:48:59 +0100
Subject: [PATCH] Add support for Joomla 2.5.18+ encryption support using
 phpass

---
 templates/settings.php |  2 +-
 user_sql.php           | 27 ++++++++++++++++++++++-----
 2 files changed, 23 insertions(+), 6 deletions(-)

diff --git a/templates/settings.php b/templates/settings.php
index 8db6f1b..a682584 100644
--- a/templates/settings.php
+++ b/templates/settings.php
@@ -44,7 +44,7 @@ $cfgClass = $ocVersion >= 7 ? 'section' : 'personalblock';
             <tr><td><label for="sql_column_password"><?php echo $l -> t('Password Column'); ?></label></td><td><input type="text" id="sql_column_password" name="sql_column_password" value="<?php echo $_['sql_column_password']; ?>" /></td></tr>
             <tr><td><label for="sql_column_displayname"><?php echo $l -> t('Real Name Column'); ?></label></td><td><input type="text" id="sql_column_displayname" name="sql_column_displayname" value="<?php echo $_['sql_column_displayname']; ?>" /></td></tr>
             <tr><td><label for="crypt_type"><?php echo $l -> t('Encryption Type'); ?></label></td>
-                <?php $crypt_types = array('md5' => 'MD5', 'md5crypt' => 'MD5 Crypt', 'cleartext' => 'Cleartext', 'mysql_encrypt' => 'mySQL ENCRYPT()', 'system' => 'System (crypt)', 'mysql_password' => 'mySQL PASSWORD()', 'joomla' => 'Joomla MD5 Encryption'); ?>
+                <?php $crypt_types = array('md5' => 'MD5', 'md5crypt' => 'MD5 Crypt', 'cleartext' => 'Cleartext', 'mysql_encrypt' => 'mySQL ENCRYPT()', 'system' => 'System (crypt)', 'mysql_password' => 'mySQL PASSWORD()', 'joomla' => 'Joomla MD5 Encryption', 'joomla2' => 'Joomla > 2.5.18 phpass'); ?>
                 <td><select id="crypt_type" name="crypt_type">
                     <?php 
                         foreach ($crypt_types as $driver => $name):
diff --git a/user_sql.php b/user_sql.php
index 8f7440f..e2e4e1a 100644
--- a/user_sql.php
+++ b/user_sql.php
@@ -8,7 +8,7 @@
  *
  * credits go to Ed W for several SQL injection fixes and caching support
  * credits go to Frédéric France for providing Joomla support
- * credits go to
+ * credits go to Mark Jansenn for providing Joomla 2.5.18+ / 3.2.1+ support
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU AFFERO GENERAL PUBLIC LICENSE
@@ -150,7 +150,7 @@ class OC_USER_SQL extends OC_User_Backend implements OC_User_Interface
     public function setPassword($uid, $password)
     {
         // Update the user's password - this might affect other services, that
-        // user the same database, as well
+        // use the same database, as well
         OC_Log::write('OC_USER_SQL', "Entering setPassword for UID: $uid", OC_Log::DEBUG);
         if(!$this -> db_conn)
         {
@@ -174,7 +174,14 @@ class OC_USER_SQL extends OC_User_Backend implements OC_User_Interface
             return false;
         }
         $old_password = $row[$this -> sql_column_password];
-        $enc_password = $this -> pacrypt($password, $old_password);
+        if($this -> crypt_type == 'joomla2')
+        {
+            $hasher = new PasswordHash(10, true);
+            $enc_password = $hasher->HashPassword($password);
+        } else
+        {
+            $enc_password = $this -> pacrypt($password, $old_password);
+        }
         $query = "UPDATE $this->sql_table SET $this->sql_column_password = :enc_password WHERE $this->sql_column_username = :uid";
         OC_Log::write('OC_USER_SQL', "Preapring query: $query", OC_Log::DEBUG);
         $result = $this -> db -> prepare($query);
@@ -230,7 +237,17 @@ class OC_USER_SQL extends OC_User_Backend implements OC_User_Interface
             return false;
         }
         OC_Log::write('OC_USER_SQL', "Encrypting and checking password", OC_Log::DEBUG);
-        if($this -> pacrypt($password, $row[$this -> sql_column_password]) == $row[$this -> sql_column_password])
+        // Joomla 2.5.18 switched to phPass, which doesn't play nice with the way
+        // we check passwords
+        if($this -> crypt_type == 'joomla2')
+        {
+            $hasher = new PasswordHash(10, true);
+            $ret = $hasher -> CheckPassword($password, $row[$this -> sql_column_password]);
+        } else
+        {
+            $ret = $this -> pacrypt($password, $row[$this -> sql_column_password]) == $row[$this -> sql_column_password];
+        }
+        if($ret)
         {
             OC_Log::write('OC_USER_SQL', "Passwords matching, return true", OC_Log::DEBUG);
             if($this -> strip_domain)
@@ -262,7 +279,7 @@ class OC_USER_SQL extends OC_User_Backend implements OC_User_Interface
             return false;
         }
         $query = "SELECT $this->sql_column_username FROM $this->sql_table";
-        $search = $this->doUserDomainMapping($search);
+        $search = $this -> doUserDomainMapping($search);
         if($search != '')
             $query .= " WHERE $this->sql_column_username LIKE :search";
         if($this -> sql_column_active != '')