framework/base/Security.php
public function validatePassword($password, $hash)
    {
        if (!is_string($password) || $password === '') {
            throw new InvalidArgumentException('Password must be a string and cannot be empty.');
        }

        if (!preg_match('/^\$2[axy]\$(\d\d)\$[\.\/0-9A-Za-z]{22}/', $hash, $matches)
            || $matches[1] < 4
            || $matches[1] > 30
        ) {
            throw new InvalidArgumentException('Hash is invalid.');
        }

        if (function_exists('password_verify')) {
            return password_verify($password, $hash);
        }

        $test = crypt($password, $hash);
        $n = strlen($test);
        if ($n !== 60) {
            return false;
        }

        return $this->compareString($test, $hash);
    }
public function validatePassword($password, $hash)
    {
        if (!is_string($password) || $password === '') {
            throw new InvalidArgumentException('Password must be a string and cannot be empty.');
        }

        if (!preg_match('/^\$2[axy]\$(\d\d)\$[\.\/0-9A-Za-z]{22}/', $hash, $matches)
            || $matches[1] < 4
            || $matches[1] > 30
        ) {
            throw new InvalidArgumentException('Hash is invalid.');
        }

        if (function_exists('password_verify')) {
            return password_verify($password, $hash);
        }

        $test = crypt($password, $hash);
        $n = strlen($test);
        if ($n !== 60) {
            return false;
        }

        return $this->compareString($test, $hash);
    }
public function validatePassword ( $ password , $ hash ) { if ( ! is_string ( $ password ) || $ password === '' ) { throw new InvalidArgumentException ( 'Password must be a string and cannot be empty.' ) ; } if ( ! preg_match ( '/^\$2[axy]\$(\d\d)\$[\.\/0-9A-Za-z]{22}/' , $ hash , $ matches ) || $ matches [ 1 ] < 4 || $ matches [ 1 ] > 30 ) { throw new InvalidArgumentException ( 'Hash is invalid.' ) ; } if ( function_exists ( 'password_verify' ) ) { return password_verify ( $ password , $ hash ) ; } $ test = crypt ( $ password , $ hash ) ; $ n = strlen ( $ test ) ; if ( $ n !== 60 ) { return false ; } return $ this -> compareString ( $ test , $ hash ) ; }
Verifies a password against a hash.
@param string $password The password to verify.
@param string $hash The hash to verify the password against.
@return bool whether the password is correct.
@throws InvalidArgumentException on bad password/hash parameters or if crypt() with Blowfish hash is not available.
@see generatePasswordHash()
Verifies a password against a hash .