Make $argon check separate from bcrypt check

David Brooks · David Brooks · commit 4258b5e9e971 · 2019-12-03T09:08:02.000-05:00
diff --git a/src/Symfony/Component/Security/Core/Encoder/NativePasswordEncoder.php b/src/Symfony/Component/Security/Core/Encoder/NativePasswordEncoder.php
@@ -80,12 +80,12 @@ public function isPasswordValid(string $encoded, string $raw, ?string $salt): bo
             return false;
         }
 
-        if (0 !== strpos($encoded, '$argon')) {
-            if (0 === strpos($encoded, '$2')) {
-                // BCrypt encodes only the first 72 chars
-                return 72 >= \strlen($raw) && password_verify($raw, $encoded);
-            }
+        if (0 === strpos($encoded, '$2')) {
+            // BCrypt encodes only the first 72 chars
+            return 72 >= \strlen($raw) && password_verify($raw, $encoded);
+        }
 
+        if (0 !== strpos($encoded, '$argon')) {
             return password_verify($raw, $encoded);
         }
 
diff --git a/src/Symfony/Component/Security/Core/Encoder/SodiumPasswordEncoder.php b/src/Symfony/Component/Security/Core/Encoder/SodiumPasswordEncoder.php
@@ -80,12 +80,12 @@ public function isPasswordValid(string $encoded, string $raw, ?string $salt): bo
             return false;
         }
 
-        if (0 !== strpos($encoded, '$argon')) {
-            if (72 >= \strlen($raw) && 0 === strpos($encoded, '$2')) {
-                // Accept validating BCrypt passwords for seamless migrations
-                return password_verify($raw, $encoded);
-            }
+        if (72 >= \strlen($raw) && 0 === strpos($encoded, '$2')) {
+            // Accept validating BCrypt passwords for seamless migrations
+            return password_verify($raw, $encoded);
+        }
 
+        if (0 !== strpos($encoded, '$argon')) {
             return password_verify($raw, $encoded);
         }
 
