handshake & password hashing

[olaulau]

Hi again ;

I saw that you rewrote the hashing thing again, to take into account old and new versions of Ampache.

ampacheapi-php/src/AmpacheApi.php

Line 500 in 77dc9ac

$key = $this->password; // New ampache versions save this password encrypted

When did Ampache started hashing passwords into database ? Maybe we can rely on API version ?

Also, I believe your code doesn't work, I cannot auth to fresh new ampache install with this, whereas reverting this API client to 1.0.3 works.

I can try to work on this little part if you want.

[lachlan-00]

The flip is that the password was saved unencrypted in the database of Ampache.

The old library code would hash the unencrypted password but now that first step is done by the server.

The library tries both ways with an encrypted source password and then an unencrypted one (

ampacheapi-php/src/AmpacheApi.php

Line 514 in 77dc9ac

// try using unencrypted password from database

)

    public function connect(): bool
    {
        // Set up the handshake
        $time       = time();
        $key        = $this->password; // New ampache versions save this password encrypted
        $passphrase = hash('sha256', $time . $key);

        $this->_debug('CONNECT', "Using " . $this->username . " / " . $passphrase);

        $options = [
            'timestamp' => $time,
            'auth' => $passphrase,
            'version' => $this->server_version,
            'user' => $this->username
        ];

        $results = $this->send_command('handshake', $options);
        if (!$results || empty($results->auth)) {
            // try using unencrypted password from database
            $key             = hash('sha256', $this->password);
            $passphrase      = hash('sha256', $time . $key);
            $options['auth'] = $passphrase;
            $this->_debug('CONNECT', "Using " . $this->username . " / " . $passphrase);
            $results = $this->send_command('handshake', $options);
            if (!$results || empty($results->auth)) {
                $this->set_state('ERROR');

                return false;
            }
        }

This should work for any API version available on v6 and v7 servers

I'm actually in the middle of rewriting the ampache and subsonic remote catalogs as the introduction of song_tags was missed in the api list of methods.

Develop installs shuld be working correctly and a stable release will be probably next week after i clean up and test

[olaulau]

I tried with latest ampache develop branch this evening, didn't work.
I also think making 2 queries is probably useless if we can rely on api version for this behaviour.

I will try again tomorrow evening, and debug this.

[lachlan-00]

Sure, that's good to know you're getting issues so we can fix that.

The fallback is a backcompat workaround in case it didn't work, the passwords sent should be the sha256 string now

I'm currently testing on develop.ampache.dev and 6.ampache.dev for sources if you want to try there.

[olaulau]

from docs/CHALGELOG.md :

3.5-Alpha1 2008-12-31
[...]
Changed passwords to SHA1 will prompt to reset password

So if I'm not wrong, passwords are hashed since more than 16 years in Ampache.

[lachlan-00]

It's not the password in Ampache, the password for the remote Ampache Catalog.

That was the one that used to be unencrypted in the DB

it's a bit confusing but i meant this one when you add a catalog.

[olaulau]

ok but ... when trying to connect the PHP API to an ampache server, you provide and test ampache login & passwords, not the catalogue one ?

[lachlan-00]

This should be solved now. we're checking whether we've been sent a hash with

ampacheapi-php/src/AmpacheApi.php

Line 515 in 4745a60

$key = (preg_match('/^[a-f0-9]{64}$/i', $this->password) === 1)

I've created the examples folder and done testing with xml and json using both encrypted and unencrypted passwords here https://github.com/ampache/ampacheapi-php/blob/4745a60b91bd1281b348c4c370f300172e7631f9/examples/list.php

[olaulau]

I don't understand why you would send hashed password :

ampacheapi-php/examples/list.php

Line 33 in 4745a60

$config['password'] = $hash;

API user provides plain password, despites it is encrypted or not into DB.

[lachlan-00]

You don't want to store plain text in the database so when the plugin saves the data it's hashed and stored.

so we have to be able to handshake from a stored password or plaintext