[PasswordHasher] Prevent PHP fatal error when using auto algorithm

matason · matason · commit dca28a219cde · 2021-06-07T08:12:34.000+01:00
diff --git a/src/Symfony/Component/PasswordHasher/Hasher/PasswordHasherFactory.php b/src/Symfony/Component/PasswordHasher/Hasher/PasswordHasherFactory.php
@@ -116,9 +116,13 @@ private function getHasherConfigFromAlgorithm(array $config): array
         if ('auto' === $config['algorithm']) {
             // "plaintext" is not listed as any leaked hashes could then be used to authenticate directly
             if (SodiumPasswordHasher::isSupported()) {
-                $algorithms = ['native', 'sodium', 'pbkdf2', $config['hash_algorithm']];
+                $algorithms = ['native', 'sodium', 'pbkdf2'];
             } else {
-                $algorithms = ['native', 'pbkdf2', $config['hash_algorithm']];
+                $algorithms = ['native', 'pbkdf2'];
+            }
+
+            if ($config['hash_algorithm'] ?? '') {
+                $algorithms[] = $config['hash_algorithm'];
             }
 
             $hasherChain = [];
diff --git a/src/Symfony/Component/PasswordHasher/Tests/Hasher/PasswordHasherFactoryTest.php b/src/Symfony/Component/PasswordHasher/Tests/Hasher/PasswordHasherFactoryTest.php
@@ -18,6 +18,7 @@
 use Symfony\Component\PasswordHasher\Hasher\PasswordHasherAwareInterface;
 use Symfony\Component\PasswordHasher\Hasher\PasswordHasherFactory;
 use Symfony\Component\PasswordHasher\Hasher\SodiumPasswordHasher;
+use Symfony\Component\PasswordHasher\PasswordHasherInterface;
 use Symfony\Component\Security\Core\Encoder\PlaintextPasswordEncoder;
 use Symfony\Component\Security\Core\User\InMemoryUser;
 use Symfony\Component\Security\Core\User\UserInterface;
@@ -85,6 +86,16 @@ public function testGetHasherConfiguredForConcreteClassWithClassName()
         $this->assertEquals($expectedHasher->hash('foo', ''), $hasher->hash('foo', ''));
     }
 
+    public function testGetHasherConfiguredWithAuto()
+    {
+        $factory = new PasswordHasherFactory([
+            'auto' => ['algorithm' => 'auto'],
+        ]);
+
+        $hasher = $factory->getPasswordHasher('auto');
+        $this->assertInstanceOf(PasswordHasherInterface::class, $hasher);
+    }
+
     public function testGetNamedHasherForHasherAware()
     {
         $factory = new PasswordHasherFactory([
