Merge pull request #9193 from freezy-sk/feature/9177-password-cost-setting

[Fixes #9177] Password Hash Cost setting for Security component

framework/CHANGELOG.md

@@ -47,6 +47,7 @@ Yii Framework 2 Change Log
 - Enh #9011: Allow `yii\widgets\MaskedInput` to produce an input tag of a custom type (TriAnMan)
 - Enh #9038: Write warning to log in case `FileCache` fails to write into file (foccy)
 - Enh #9149: Print directory migrationPath in a `yii migrate` command error. (RusAlex)
+- Enh #9177: Added password hash cost setting to Security component (freezy-sk)
 - Chg #6354: `ErrorHandler::logException()` will now log the whole exception object instead of only its string representation (cebe)
 - Chg #8556: Extracted `yii\web\User::getAuthManager()` method (samdark)
 

framework/base/Security.php

@@ -79,7 +79,13 @@ class Security extends Component
      * - 'crypt' - use PHP `crypt()` function.
      */
     public $passwordHashStrategy = 'crypt';
-
+    /**
+     * @var integer Default cost used for password hashing.
+     * Allowed value is between 4 and 31.
+     * @see generatePasswordHash()
+     * @since 2.0.6
+     */
+    public $passwordHashCost = 13;
 
     /**
      * Encrypts data using a password.
@@ -540,8 +546,12 @@ class Security extends Component
      * @throws InvalidConfigException when an unsupported password hash strategy is configured.
      * @see validatePassword()
      */
-    public function generatePasswordHash($password, $cost = 13)
+    public function generatePasswordHash($password, $cost = null)
     {
+        if ($cost === null) {
+            $cost = $this->passwordHashCost;
+        }
+
         switch ($this->passwordHashStrategy) {
             case 'password_hash':
                 if (!function_exists('password_hash')) {

tests/framework/base/SecurityTest.php

@@ -72,6 +72,7 @@ class SecurityTest extends TestCase
             return;
         }
         $this->security->passwordHashStrategy = $passwordHashStrategy;
+        $this->security->passwordHashCost = 4;  // minimum blowfish's value is enough for tests
 
         $password = 'secret';
         $hash = $this->security->generatePasswordHash($password);