m3 Security Fixes

Modules/M3/Http/Middleware/BasicAuth.php

@@ -4,69 +4,54 @@ namespace Modules\M3\Http\Middleware;
 
 use Closure;
 use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
 
 class BasicAuth
 {
-    /**
-     * Handle an incoming request.
-     *
-     * @param Request $request
-     * @param Closure $next
-     *
-     * @return mixed
-     */
-    public function handle(Request $request, Closure $next)
+    public function handle(Request $request, Closure $next): mixed
     {
+        $login = trim((string) m3_user());
+        $password = (string) m3_legacy_password();
 
-        // select md5 or crypt for $mode. md5 is for md5 encoded passwords, crypt is for passwords encoded using apache's httpasswd
-        $mode = 'crypt';
-        if (! m3_user() !== '') {
-            $this->authenticate();
-        } else {
-            if ($this->check_pass(m3_user(), m3_legacy_password(), $mode, '%%SYSTEM%%')) {
-                return $next($request);
-            } else {
-                $this->authenticate();
-            }
+        if ($login !== '' && $this->checkPassword($login, $password, '%%SYSTEM%%')) {
+            return $next($request);
         }
 
+        return $this->unauthorized();
     }
 
-    public static function check_pass($login, $password, $mode, $password_file)
+    private function checkPassword(string $login, string $password, string $passwordFile): bool
     {
-        if (! $fh = fopen($password_file, 'r')) {
-            exit('<P>Could Not Open Password File');
+        if (! is_readable($passwordFile)) {
+            return false;
         }
-        $match = 0;
-        while (! feof($fh)) {
-            $line = fgets($fh, 4096);
-            $from_file = explode(':', $line);
-            if ($from_file[0] == $login) {
-                if ($mode == 'crypt') {
-                    $salt = substr($from_file[1], 0, 2);
-                    $user_pass = crypt($password, $salt);
-                } elseif ($mode == 'md5') {
-                    $user_pass = md5($password);
-                }
-                if (rtrim($from_file[1]) == $user_pass) {
-                    $match = 1;
-                    break;
+
+        $handle = fopen($passwordFile, 'rb');
+        if ($handle === false) {
+            return false;
+        }
+
+        try {
+            while (($line = fgets($handle)) !== false) {
+                $parts = explode(':', trim($line), 2);
+                if (count($parts) !== 2 || ! hash_equals($parts[0], $login)) {
+                    continue;
                 }
+
+                $storedHash = trim($parts[1]);
+
+                return $storedHash !== '' && password_verify($password, $storedHash);
             }
+        } finally {
+            fclose($handle);
         }
-        if ($match) {
-            return 1;
-        } else {
-            return 0;
-        }
-        fclose($fh);
+
+        return false;
     }
 
-    public static function authenticate()
+    private function unauthorized(): Response
     {
-        header('WWW-Authenticate: Basic realm="RESTRICTED ACCESS"');
-        header('HTTP/1.0 401 Unauthorized');
-        echo '<h1>INVALID USERNAME OR PASSWORD. ACCESS DENIED<h1>';
-        exit;
+        return response('INVALID USERNAME OR PASSWORD. ACCESS DENIED', 401)
+            ->header('WWW-Authenticate', 'Basic realm="RESTRICTED ACCESS"');
     }
 }