Deprecation: #85804 - Salted password hash class deprecations

See forge#85804

Description

Selecting the hash algorithm used to store frontend and backend user hashes is now a "preset" and can be changed using "Admin tools" -> "Settings" -> "Configuration Presets".

Existing settings are updated automatically when upgrading from an older TYPO3 version to TYPO3 v9. The detail list below is only interesting for instances that need to run custom hash mechanisms.

The password hash mechanism used for backend user passwords has been moved from $GLOBALS['TYPO3_CONF_VARS']['EXTENSIONS']['saltedpasswords']['BE']['saltedPWHashingMethod'] to $GLOBALS['TYPO3_CONF_VARS']['BE']['passwordHashing']['className'] . Options for a specific hash algorithms can be defined using $GLOBALS['TYPO3_CONF_VARS']['BE']['passwordHashing']['options'] .

The password hash mechanism used for frontend user passwords has been moved from $GLOBALS['TYPO3_CONF_VARS']['EXTENSIONS']['saltedpasswords']['FE']['saltedPWHashingMethod'] to $GLOBALS['TYPO3_CONF_VARS']['FE']['passwordHashing']['className'] . Options for a specific hash algorithms can be defined using $GLOBALS['TYPO3_CONF_VARS']['FE']['passwordHashing']['options'] .

Custom password hash algorithms should now be registered in $GLOBALS['TYPO3_CONF_VARS']['SYS']['availablePasswordHashAlgorithms'] . The usage of the former array entry $GLOBALS['TYPO3_CONF_VARS']['SC_OPTIONS']['ext/saltedpasswords']['saltMethods'] has been marked as deprecated.

These interfaces and classes have been marked as deprecated and should not be implemented any longer:

  • \TYPO3\CMS\Saltedpasswords\Salt\ComposedSaltInterface
  • \TYPO3\CMS\Saltedpasswords\Salt\AbstractComposedSalt
  • \TYPO3\CMS\Saltedpasswords\Salt\Utility\ExtensionManagerConfigurationUtility
  • \TYPO3\CMS\Saltedpasswords\Salt\Utility\SaltedPasswordsUtility

An interface has been changed:

  • TYPO3\CMS\Saltedpasswords\Salt\SaltInterface->getHashedPassword(string $password) - The second argument has been dropped. Classes implementing the interface should remove the second argument.

These methods have been marked as deprecated:

  • TYPO3\CMS\Saltedpasswords\Salt\Argon2iSalt->getOptions()
  • TYPO3\CMS\Saltedpasswords\Salt\Argon2iSalt->setOptions()
  • TYPO3\CMS\Saltedpasswords\Salt\BcryptSalt->getOptions()
  • TYPO3\CMS\Saltedpasswords\Salt\BcryptSalt->setOptions()
  • TYPO3\CMS\Saltedpasswords\Salt\BlowfishSalt->getHashCount()
  • TYPO3\CMS\Saltedpasswords\Salt\BlowfishSalt->getMaxHashCount()
  • TYPO3\CMS\Saltedpasswords\Salt\BlowfishSalt->getMinHashCount()
  • TYPO3\CMS\Saltedpasswords\Salt\BlowfishSalt->getSaltLength()
  • TYPO3\CMS\Saltedpasswords\Salt\BlowfishSalt->getSetting()
  • TYPO3\CMS\Saltedpasswords\Salt\BlowfishSalt->setHashCount()
  • TYPO3\CMS\Saltedpasswords\Salt\BlowfishSalt->setMaxHashCount()
  • TYPO3\CMS\Saltedpasswords\Salt\BlowfishSalt->setMinHashCount()
  • TYPO3\CMS\Saltedpasswords\Salt\Md5Salt->getSetting()
  • TYPO3\CMS\Saltedpasswords\Salt\Md5Salt->getSaltLength()
  • TYPO3\CMS\Saltedpasswords\Salt\Pbkdf2Salt->getHashCount()
  • TYPO3\CMS\Saltedpasswords\Salt\Pbkdf2Salt->getMaxHashCount()
  • TYPO3\CMS\Saltedpasswords\Salt\Pbkdf2Salt->getMinHashCount()
  • TYPO3\CMS\Saltedpasswords\Salt\Pbkdf2Salt->getSaltLength()
  • TYPO3\CMS\Saltedpasswords\Salt\Pbkdf2Salt->getSetting()
  • TYPO3\CMS\Saltedpasswords\Salt\Pbkdf2Salt->setHashCount()
  • TYPO3\CMS\Saltedpasswords\Salt\Pbkdf2Salt->setMaxHashCount()
  • TYPO3\CMS\Saltedpasswords\Salt\Pbkdf2Salt->setMinHashCount()
  • TYPO3\CMS\Saltedpasswords\Salt\PhpassSalt->getHashCount()
  • TYPO3\CMS\Saltedpasswords\Salt\PhpassSalt->getMaxHashCount()
  • TYPO3\CMS\Saltedpasswords\Salt\PhpassSalt->getMinHashCount()
  • TYPO3\CMS\Saltedpasswords\Salt\PhpassSalt->getSaltLength()
  • TYPO3\CMS\Saltedpasswords\Salt\PhpassSalt->getSetting()
  • TYPO3\CMS\Saltedpasswords\Salt\PhpassSalt->setHashCount()
  • TYPO3\CMS\Saltedpasswords\Salt\PhpassSalt->setMaxHashCount()
  • TYPO3\CMS\Saltedpasswords\Salt\PhpassSalt->setMinHashCount()

These methods changed their signature:

  • TYPO3\CMS\Saltedpasswords\Salt\BlowfishSalt->getHashedPassword() - Second argument marked as deprecated
  • TYPO3\CMS\Saltedpasswords\Salt\Md5Salt->getHashedPassword() - Second argument marked as deprecated
  • TYPO3\CMS\Saltedpasswords\Salt\Pbkdf2Salt->getHashedPassword() - Second argument marked as deprecated
  • TYPO3\CMS\Saltedpasswords\Salt\PhpassSalt->getHashedPassword() - Second argument marked as deprecated

These methods changed their visibility from public to protected:

  • TYPO3\CMS\Saltedpasswords\Salt\BlowfishSalt->isValidSalt()
  • TYPO3\CMS\Saltedpasswords\Salt\BlowfishSalt->base64Encode()
  • TYPO3\CMS\Saltedpasswords\Salt\Md5Salt->isValidSalt()
  • TYPO3\CMS\Saltedpasswords\Salt\Md5Salt->base64Encode()
  • TYPO3\CMS\Saltedpasswords\Salt\Pbkdf2Salt->isValidSalt()
  • TYPO3\CMS\Saltedpasswords\Salt\Pbkdf2Salt->base64Encode()
  • TYPO3\CMS\Saltedpasswords\Salt\Pbkdf2Salt->base64Decode()
  • TYPO3\CMS\Saltedpasswords\Salt\PhpassSalt->isValidSalt()
  • TYPO3\CMS\Saltedpasswords\Salt\PhpassSalt->base64Encode()

These class constants have been marked as deprecated and will be removed in TYPO3 v10:

  • TYPO3\CMS\Saltedpasswords\Salt\BlowfishSalt::ITOA64
  • TYPO3\CMS\Saltedpasswords\Salt\BlowfishSalt::HASH_COUNT
  • TYPO3\CMS\Saltedpasswords\Salt\BlowfishSalt::MAX_HASH_COUNT
  • TYPO3\CMS\Saltedpasswords\Salt\BlowfishSalt::MIN_HASH_COUNT
  • TYPO3\CMS\Saltedpasswords\Salt\Md5Salt::ITOA64
  • TYPO3\CMS\Saltedpasswords\Salt\Pbkdf2Salt::ITOA64
  • TYPO3\CMS\Saltedpasswords\Salt\Pbkdf2Salt::HASH_COUNT
  • TYPO3\CMS\Saltedpasswords\Salt\Pbkdf2Salt::MAX_HASH_COUNT
  • TYPO3\CMS\Saltedpasswords\Salt\Pbkdf2Salt::MIN_HASH_COUNT
  • TYPO3\CMS\Saltedpasswords\Salt\PhpassSalt::ITOA64
  • TYPO3\CMS\Saltedpasswords\Salt\PhpassSalt::HASH_COUNT
  • TYPO3\CMS\Saltedpasswords\Salt\PhpassSalt::MAX_HASH_COUNT
  • TYPO3\CMS\Saltedpasswords\Salt\PhpassSalt::MIN_HASH_COUNT

Impact

Using functionality from the above list will trigger PHP E_USER_DEPRECATED errors.

Affected Installations

Almost no TYPO3 instances are directly affected by the changes outlined above. A configuration upgrade is in place to move from old to new settings when calling the install tool the first time after upgrade without further user interaction.

If in rare cases an existing TYPO3 instance runs custom salt mechanisms, the extension scanner will find affected code places that should be adapted.

Migration

If the extension scanner finds affected code, adapt the method calls, class constant usages and interface usages.