Wrap both BCrypt and non-Argon checks under a single if statement

David Brooks · David Brooks · commit 5f554e9bf5a2 · 2019-12-02T16:41:02.000-05:00
diff --git a/src/Symfony/Component/Security/Core/Encoder/NativePasswordEncoder.php b/src/Symfony/Component/Security/Core/Encoder/NativePasswordEncoder.php
@@ -80,12 +80,12 @@ public function isPasswordValid(string $encoded, string $raw, ?string $salt): bo
             return false;
         }
 
-        if (0 === strpos($encoded, '$2')) {
-            // BCrypt encodes only the first 72 chars
-            return 72 >= \strlen($raw) && password_verify($raw, $encoded);
-        }
-
         if (0 !== strpos($encoded, '$argon')) {
+            if (0 === strpos($encoded, '$2')) {
+                // BCrypt encodes only the first 72 chars
+                return 72 >= \strlen($raw) && password_verify($raw, $encoded);
+            }
+
             return password_verify($raw, $encoded);
         }
 
diff --git a/src/Symfony/Component/Security/Core/Encoder/SodiumPasswordEncoder.php b/src/Symfony/Component/Security/Core/Encoder/SodiumPasswordEncoder.php
@@ -80,12 +80,12 @@ public function isPasswordValid(string $encoded, string $raw, ?string $salt): bo
             return false;
         }
 
-        if (72 >= \strlen($raw) && 0 === strpos($encoded, '$2')) {
-            // Accept validating BCrypt passwords for seamless migrations
-            return password_verify($raw, $encoded);
-        }
-
         if (0 !== strpos($encoded, '$argon')) {
+            if (72 >= \strlen($raw) && 0 === strpos($encoded, '$2')) {
+                // Accept validating BCrypt passwords for seamless migrations
+                return password_verify($raw, $encoded);
+            }
+
             return password_verify($raw, $encoded);
         }
 
