Schlaefer / Saito

src/Auth/Mlf2PasswordHasher.php

<?php

declare(strict_types=1);

/**
 * Saito - The Threaded Web Forum
 *
 * @copyright Copyright (c) the Saito Project Developers
 * @link https://github.com/Schlaefer/Saito
 * @license http://opensource.org/licenses/MIT
 */

namespace App\Auth;

use Authentication\PasswordHasher\AbstractPasswordHasher;
use Cake\Utility\Security;
use Cake\Utility\Text;

/**
 * mylittleforum 2.x salted sha1 passwords.
 */
class Mlf2PasswordHasher extends AbstractPasswordHasher
{
    /**
     * {@inheritDoc}
     */
    public function hash($password)
    {
        // compare to includes/functions.inc.php generate_pw_hash() mlf 2.3
        $salt = self::_generateRandomString(10);
        $saltedHash = sha1($password . $salt);
        $hashWithSalt = $saltedHash . $salt;

        return $hashWithSalt;
    }

    /**
     * Generate random string
     *
     * @param int $maxLength maximum length
     * @return string
     */
    protected static function _generateRandomString($maxLength = null)
    {
        $string = Security::hash(Text::uuid());
        if ($maxLength) {

The expression $maxLength of type integer|null is loosely compared to true; this is ambiguous if the integer can be 0. You might want to explicitly use !== null instead.

            $string = substr($string, 0, $maxLength);
        }

        return $string;
    }

    /**
     * {@inheritDoc}
     */
    public function check($password, $hash)
    {
        $out = false;
        // compare to includes/functions.inc.php is_pw_correct() mlf 2.3
        $saltedHash = substr($hash, 0, 40);
        $salt = substr($hash, 40, 10);
        if (sha1($password . $salt) == $saltedHash) :
            $out = true;
        endif;

        return $out;
    }
}