Added encryption options to account creation

Dockerfile

@@ -94,6 +94,15 @@ RUN \
   ./configure && \
   make && make install
 
+## Scrypt Extension
+FROM compile AS scrypt
+RUN \
+  git clone --depth 1 --branch master https://github.com/DomBlack/php-scrypt.git && \
+  cd php-scrypt && \
+  phpize && \
+  ./configure --enable-scrypt && \
+  make && make install
+
 ## YAML Extension
 FROM compile AS yaml
 RUN \
@@ -227,6 +236,7 @@ COPY --from=imagick /usr/local/lib/php/extensions/no-debug-non-zts-20200930/imag
 COPY --from=yaml /usr/local/lib/php/extensions/no-debug-non-zts-20200930/yaml.so /usr/local/lib/php/extensions/no-debug-non-zts-20200930/
 COPY --from=maxmind /usr/local/lib/php/extensions/no-debug-non-zts-20200930/maxminddb.so /usr/local/lib/php/extensions/no-debug-non-zts-20200930/
 COPY --from=mongodb /usr/local/lib/php/extensions/no-debug-non-zts-20200930/mongodb.so /usr/local/lib/php/extensions/no-debug-non-zts-20200930/
+COPY --from=scrypt /usr/local/lib/php/extensions/no-debug-non-zts-20200930/scrypt.so /usr/local/lib/php/extensions/no-debug-non-zts-20200930/
 
 # Add Source Code
 COPY ./app /usr/src/code/app
@@ -276,6 +286,7 @@ RUN mkdir -p /etc/letsencrypt/live/ && chmod -Rf 755 /etc/letsencrypt/live/
 
 # Enable Extensions
 RUN echo extension=swoole.so >> /usr/local/etc/php/conf.d/swoole.ini
+RUN echo extension=scrypt.so >> /usr/local/etc/php/conf.d/scrypt.ini
 RUN echo extension=redis.so >> /usr/local/etc/php/conf.d/redis.ini
 RUN echo extension=imagick.so >> /usr/local/etc/php/conf.d/imagick.ini
 RUN echo extension=yaml.so >> /usr/local/etc/php/conf.d/yaml.ini

app/config/collections.php

@@ -981,6 +981,17 @@ $collections = [
                 'required' => false,
                 'default' => null,
                 'array' => false,
+                'filters' => ['encrypt'],
+            ],
+            [
+                '$id' => 'hash', // Hashing algorithm used to hash the password
+                'type' => Database::VAR_STRING,
+                'format' => '',
+                'size' => 256,
+                'signed' => true,
+                'required' => false,
+                'default' => null,
+                'array' => false,
                 'filters' => [],
             ],
             [

app/controllers/api/account.php

@@ -49,13 +49,15 @@ App::post('/v1/account')
     ->param('email', '', new Email(), 'User email.')
     ->param('password', '', new Password(), 'User password. Must be at least 8 chars.')
     ->param('name', '', new Text(128), 'User name. Max length: 128 chars.', true)
+    ->param('hash', 'bcrypt', new WhiteList(['bcrypt', 'scrypt', 'md5']), 'Hashing algorithm for password. The default value is bcrypt.', true)
+    ->param('import', false, new Boolean(), 'Are you importing hashed password?', true)
     ->inject('request')
     ->inject('response')
     ->inject('project')
     ->inject('dbForProject')
     ->inject('audits')
     ->inject('usage')
-    ->action(function ($userId, $email, $password, $name, $request, $response, $project, $dbForProject, $audits, $usage) {
+    ->action(function ($userId, $email, $password, $name, $hash, $import, $request, $response, $project, $dbForProject, $audits, $usage) {
         /** @var Appwrite\Utopia\Request $request */
         /** @var Appwrite\Utopia\Response $response */
         /** @var Utopia\Database\Document $project */
@@ -63,6 +65,10 @@ App::post('/v1/account')
         /** @var Appwrite\Event\Event $audits */
         /** @var Appwrite\Stats\Stats $usage */
 
+        if(!$import && $hash === 'md5') {
+            throw new Exception('For security reasons, MD5 hashing is only allowed for importing accounts. Please use bcrypt instead.');
+        }
+
         $email = \strtolower($email);
         if ('console' === $project->getId()) {
             $whitelistEmails = $project->getAttribute('authWhitelistEmails');
@@ -98,7 +104,8 @@ App::post('/v1/account')
                 'email' => $email,
                 'emailVerification' => false,
                 'status' => true,
-                'password' => Auth::passwordHash($password),
+                'password' => $import ? $password : Auth::passwordHash($password, $hash),
+                'hash' => $hash,
                 'passwordUpdate' => \time(),
                 'registration' => \time(),
                 'reset' => false,
@@ -169,7 +176,7 @@ App::post('/v1/account/sessions')
 
         $profile = $dbForProject->findOne('users', [new Query('deleted', Query::TYPE_EQUAL, [false]), new Query('email', Query::TYPE_EQUAL, [$email])]); // Get user by email address
 
-        if (!$profile || !Auth::passwordVerify($password, $profile->getAttribute('password'))) {
+        if (!$profile || !Auth::passwordVerify($password, $profile->getAttribute('password'), $profile->getAttribute('hash'))) {
             $audits
                 //->setParam('userId', $profile->getId())
                 ->setParam('event', 'account.sessions.failed')

src/Appwrite/Auth/Auth.php

@@ -130,26 +130,47 @@ class Auth
      *
      * One way string hashing for user passwords
      *
-     * @param $string
+     * @param string $string
+     * @param string $algo hashing algorithm to use
      *
      * @return bool|string|null
      */
-    public static function passwordHash($string)
+    public static function passwordHash(string $string, string $algo)
     {
-        return \password_hash($string, PASSWORD_BCRYPT, array('cost' => 8));
+        switch ($algo) {
+            case 'bcrypt':
+                return \password_hash($string, PASSWORD_BCRYPT, array('cost' => 8));
+            case 'scrypt':
+                return \scrypt($string, "", 8, 1, 1, 64);
+                throw new Error('Hashing algorithm scrypt not supported yet.');
+            case 'md5':
+                return \md5($string);
+        }
+
+        return null;
     }
 
     /**
      * Password verify.
      *
-     * @param $plain
-     * @param $hash
+     * @param string $plain
+     * @param string $hash
+     * @param string $algo hashing algorithm used to hash
      *
      * @return bool
      */
-    public static function passwordVerify($plain, $hash)
+    public static function passwordVerify(string $plain, string $hash, string $algo)
     {
-        return \password_verify($plain, $hash);
+        switch ($algo) {
+            case 'bcrypt':
+                return \password_verify($plain, $hash);
+            case 'scrypt':
+                return \scrypt($plain, "", 8, 1, 1, 64) === $hash;
+            case 'md5':
+                return \md5($plain) === $hash;
+        }
+
+        return false;
     }
 
     /**