php Joomla 3.2.1 密码加密
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/21304038/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Joomla 3.2.1 password encryption
提问by Gregor
When the user register on the site , and I look in the database joomla_users in the password table, there are password stored in the following formats:
当用户在网站上注册时，我在密码表中的数据库 joomla_users 中查找，密码以以下格式存储：
$P$Do8QrURFT1r0NlWf0X/grdF/aMqwqK/
$P$DH38Lch9z508gJiop3A6u0whTity390
- ........
$P$Do8QrURFT1r0NlWf0X/grdF/aMqwqK/
$P$DH38Lch9z508gJiop3A6u0whTity390
- …………
But not in the form as described in the documentation (MD5 + ":" + SALT):
但不是文档中描述的形式（MD5 + ":" + SALT）：
- 1802ebc64051d5b4f4d1b408babb5020:0PHJDbnsyX05YpKbAuLYnw2VCzFMW2VK
- 1802ebc64051d5b4f4d1b408babb5020:0PHJDbnsyX05YpKbAuLYnw2VCzFMW2VK
I need to have this clarified for me, because I'm using outside script that checks for user credentials to check for password match.
我需要为我澄清这一点，因为我正在使用检查用户凭据的外部脚本来检查密码匹配。
In my PHP script I have code that seperates SALT from password from database:
在我的 PHP 脚本中，我有将 SALT 与数据库密码分开的代码：
$parts = explode( ':', $password_database );
$crypt = $parts[0];
$salt = $parts[1];
But I can't do that if there is no dobule knot (:)
但如果没有双结我就做不到 (:)
回答by Jobin Jose
Try this,
尝试这个，
The following piece of code is creating Joomla standard password (Older Version 1.5,1.7 etc).
以下代码是创建 Joomla 标准密码（旧版本 1.5、1.7 等）。
jimport('joomla.user.helper');
$salt = JUserHelper::genRandomPassword(32);
$crypt = JUserHelper::getCryptedPassword($password_choose, $salt);
$password = $crypt.':'.$salt;
Joomla 3.2+introduced PHP's password algorithm bcryptbut it required a minimum PHP 5.3+If you plan to use bcryptmake sure your server PHP version is capable for this, read more here.
Joomla 3.2+引入了 PHP 的密码算法bcrypt，但它至少需要 PHP 5.3+如果您打算使用bcrypt，请确保您的服务器 PHP 版本能够执行此操作，请在此处阅读更多内容。
The other Version of Joomla Using the following methods (Joomla 3.x)
另一个版本的 Joomla 使用以下方法（Joomla 3.x）
jimport('joomla.user.helper');
$yourpass = JUserHelper::hashPassword($password_choose);
The older algorithm also works fine in latest version too , only difference is older version creates a 65 character password and new one creates 34 character string. always go with updated version
旧算法在最新版本中也能正常工作，唯一的区别是旧版本创建 65 个字符的密码，而新版本创建 34 个字符的字符串。始终使用更新版本
Also if you are using external script should include Joomla framework like below. This should at very top of your external php file
此外，如果您使用外部脚本，则应包含 Joomla 框架，如下所示。这应该在您的外部 php 文件的最顶部
define( '_JEXEC', 1 );
define('JPATH_BASE', dirname(__FILE__) );//this is when we are in the root
define( 'DS', DIRECTORY_SEPARATOR );
require_once ( JPATH_BASE .DS.'includes'.DS.'defines.php' );
require_once ( JPATH_BASE .DS.'includes'.DS.'framework.php' );
$mainframe =& JFactory::getApplication('site');
$mainframe->initialise();
Also you mentioned you have to check users credential then no need to check password format and all thing just use below codes after framework loads.
您还提到您必须检查用户凭据，然后无需检查密码格式，所有内容只需在框架加载后使用以下代码即可。
$credentials['username'] = $data['username']; //user entered name
$credentials['password'] = $data['password']; //users entered password
$app = JFactory::getApplication();
$error = $app->login($credentials, $options);
if (!JError::isError($error)) {
// login success
}
else{
//Failed attempt
}
hope it helps..
希望能帮助到你..
回答by David Fritsch
Joomla's default user class no longer uses salted MD5 to hash the password. The bind function of the JUserclass now calls JUserHelper::hashPassword($array['password'])to encrypt the password.
Joomla 的默认用户类不再使用加盐 MD5 来散列密码。类的绑定函数JUser现在调用JUserHelper::hashPassword($array['password'])加密密码。
That function is currently this:
该功能目前是这样的：
public static function hashPassword($password)
{
// Use PHPass's portable hashes with a cost of 10.
$phpass = new PasswordHash(10, true);
return $phpass->HashPassword($password);
}
And that means that it now relies on PHPass which you can read more about here: http://www.openwall.com/phpass/. Based on reading just the intro of this site, I'm guessing that the encryption is now bcryptinstead of MD5, but Joomla may have overriden the default encryption.
这意味着它现在依赖于 PHPass，您可以在此处阅读更多信息：http: //www.openwall.com/phpass/。基于阅读本网站的介绍，我猜测加密现在bcrypt不是 MD5，但 Joomla 可能已经覆盖了默认加密。
回答by Mikel
With David Fritsch answer I get to do a encrypted password as Joomla does:
随着大卫弗里奇的回答，我可以像 Joomla 那样做一个加密的密码：
<?php
define( '_JEXEC', 1 );
define('JPATH_BASE', dirname(__FILE__) );//this is when we are in the root
define( 'DS', DIRECTORY_SEPARATOR );
require_once( JPATH_BASE .DS.'includes'.DS.'defines.php' );
require_once( JPATH_BASE .DS.'includes'.DS.'framework.php' );
$mainframe =& JFactory::getApplication('site');
$mainframe->initialise();
jimport('joomla.user.helper');
$password = "test";
echo "<strong>Password: </strong>" . JUserHelper::hashPassword($password);
?>
Note that you have to store the file in joomla root directory, or change JPATH_BASE.
请注意，您必须将文件存储在 joomla 根目录中，或者更改 JPATH_BASE。
