[5.7] Remove depending on Hash::check() just for password verification.

Signed-off-by: Mior Muhammad Zaki <[email protected]>
laravel · Sep 18, 2018 · 09d24b6 · 09d24b6
1 parent 21ddb31
commit 09d24b6
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 3 deletions.
diff --git a/src/Illuminate/Auth/DatabaseUserProvider.php b/src/Illuminate/Auth/DatabaseUserProvider.php
@@ -152,8 +152,14 @@ protected function getGenericUser($user)
      */
     public function validateCredentials(UserContract $user, array $credentials)
     {
-        return $this->hasher->check(
-            $credentials['password'], $user->getAuthPassword()
+        $hashed = $user->getAuthPassword();
+
+        if (strlen($hashed) === 0) {
+            return false;
+        }
+
+        return password_verify(
+            $credentials['password'], $hashed
         );
     }
 }
diff --git a/src/Illuminate/Auth/EloquentUserProvider.php b/src/Illuminate/Auth/EloquentUserProvider.php
@@ -138,8 +138,13 @@ public function retrieveByCredentials(array $credentials)
     public function validateCredentials(UserContract $user, array $credentials)
     {
         $plain = $credentials['password'];
+        $hashed = $user->getAuthPassword();
 
-        return $this->hasher->check($plain, $user->getAuthPassword());
+        if (strlen($hashed) === 0) {
+            return false;
+        }
+
+        return password_verify($plain, $hashed);
     }
 
     /**