splitbrain /
dokuwiki
Complex classes like PassHash often do a lot of different things. To break such a class down, we need to identify a cohesive component within that class. A common approach to find such a component is to look for fields/methods that share the same prefixes, or suffixes. You can also have a look at the cohesion graph to spot any un-connected, or weakly-connected components.
Once you have determined the fields that belong together, you can apply the Extract Class refactoring. If the component makes sense as a sub-class, Extract Subclass is also a candidate, and is often faster.
While breaking up the class, it is a good idea to analyze how other classes use PassHash, and based on these observations, apply Extract Interface, too.
| 1 | <?php |
||
| 15 | class PassHash { |
||
| 16 | /** |
||
| 17 | * Verifies a cleartext password against a crypted hash |
||
| 18 | * |
||
| 19 | * The method and salt used for the crypted hash is determined automatically, |
||
| 20 | * then the clear text password is crypted using the same method. If both hashs |
||
| 21 | * match true is is returned else false |
||
| 22 | * |
||
| 23 | * @author Andreas Gohr <[email protected]> |
||
| 24 | * @author Schplurtz le Déboulonné <[email protected]> |
||
| 25 | * |
||
| 26 | * @param string $clear Clear-Text password |
||
| 27 | * @param string $hash Hash to compare against |
||
| 28 | * @return bool |
||
| 29 | */ |
||
| 30 | public function verify_hash($clear, $hash) { |
||
| 128 | |||
| 129 | /** |
||
| 130 | * Create a random salt |
||
| 131 | * |
||
| 132 | * @param int $len The length of the salt |
||
| 133 | * @return string |
||
| 134 | */ |
||
| 135 | public function gen_salt($len = 32) { |
||
| 143 | |||
| 144 | /** |
||
| 145 | * Initialize the passed variable with a salt if needed. |
||
| 146 | * |
||
| 147 | * If $salt is not null, the value is kept, but the lenght restriction is |
||
| 148 | * applied (unless, $cut is false). |
||
| 149 | * |
||
| 150 | * @param string|null &$salt The salt, pass null if you want one generated |
||
| 151 | * @param int $len The length of the salt |
||
| 152 | * @param bool $cut Apply length restriction to existing salt? |
||
| 153 | */ |
||
| 154 | public function init_salt(&$salt, $len = 32, $cut = true) { |
||
| 161 | |||
| 162 | // Password hashing methods follow below |
||
| 163 | |||
| 164 | /** |
||
| 165 | * Password hashing method 'smd5' |
||
| 166 | * |
||
| 167 | * Uses salted MD5 hashs. Salt is 8 bytes long. |
||
| 168 | * |
||
| 169 | * The same mechanism is used by Apache's 'apr1' method. This will |
||
| 170 | * fallback to a implementation in pure PHP if MD5 support is not |
||
| 171 | * available in crypt() |
||
| 172 | * |
||
| 173 | * @author Andreas Gohr <[email protected]> |
||
| 174 | * @author <mikey_nich at hotmail dot com> |
||
| 175 | * @link http://php.net/manual/en/function.crypt.php#73619 |
||
| 176 | * |
||
| 177 | * @param string $clear The clear text to hash |
||
| 178 | * @param string $salt The salt to use, null for random |
||
| 179 | * @return string Hashed password |
||
| 180 | */ |
||
| 181 | public function hash_smd5($clear, $salt = null) { |
||
| 191 | |||
| 192 | /** |
||
| 193 | * Password hashing method 'lsmd5' |
||
| 194 | * |
||
| 195 | * Uses salted MD5 hashs. Salt is 8 bytes long. |
||
| 196 | * |
||
| 197 | * This is the format used by LDAP. |
||
| 198 | * |
||
| 199 | * @param string $clear The clear text to hash |
||
| 200 | * @param string $salt The salt to use, null for random |
||
| 201 | * @return string Hashed password |
||
| 202 | */ |
||
| 203 | public function hash_lsmd5($clear, $salt = null) { |
||
| 207 | |||
| 208 | /** |
||
| 209 | * Password hashing method 'apr1' |
||
| 210 | * |
||
| 211 | * Uses salted MD5 hashs. Salt is 8 bytes long. |
||
| 212 | * |
||
| 213 | * This is basically the same as smd1 above, but as used by Apache. |
||
| 214 | * |
||
| 215 | * @author <mikey_nich at hotmail dot com> |
||
| 216 | * @link http://php.net/manual/en/function.crypt.php#73619 |
||
| 217 | * |
||
| 218 | * @param string $clear The clear text to hash |
||
| 219 | * @param string $salt The salt to use, null for random |
||
| 220 | * @param string $magic The hash identifier (apr1 or 1) |
||
| 221 | * @return string Hashed password |
||
| 222 | */ |
||
| 223 | public function hash_apr1($clear, $salt = null, $magic = 'apr1') { |
||
| 258 | |||
| 259 | /** |
||
| 260 | * Password hashing method 'md5' |
||
| 261 | * |
||
| 262 | * Uses MD5 hashs. |
||
| 263 | * |
||
| 264 | * @param string $clear The clear text to hash |
||
| 265 | * @return string Hashed password |
||
| 266 | */ |
||
| 267 | public function hash_md5($clear) { |
||
| 270 | |||
| 271 | /** |
||
| 272 | * Password hashing method 'sha1' |
||
| 273 | * |
||
| 274 | * Uses SHA1 hashs. |
||
| 275 | * |
||
| 276 | * @param string $clear The clear text to hash |
||
| 277 | * @return string Hashed password |
||
| 278 | */ |
||
| 279 | public function hash_sha1($clear) { |
||
| 282 | |||
| 283 | /** |
||
| 284 | * Password hashing method 'ssha' as used by LDAP |
||
| 285 | * |
||
| 286 | * Uses salted SHA1 hashs. Salt is 4 bytes long. |
||
| 287 | * |
||
| 288 | * @param string $clear The clear text to hash |
||
| 289 | * @param string $salt The salt to use, null for random |
||
| 290 | * @return string Hashed password |
||
| 291 | */ |
||
| 292 | public function hash_ssha($clear, $salt = null) { |
||
| 296 | |||
| 297 | /** |
||
| 298 | * Password hashing method 'crypt' |
||
| 299 | * |
||
| 300 | * Uses salted crypt hashs. Salt is 2 bytes long. |
||
| 301 | * |
||
| 302 | * @param string $clear The clear text to hash |
||
| 303 | * @param string $salt The salt to use, null for random |
||
| 304 | * @return string Hashed password |
||
| 305 | */ |
||
| 306 | public function hash_crypt($clear, $salt = null) { |
||
| 310 | |||
| 311 | /** |
||
| 312 | * Password hashing method 'mysql' |
||
| 313 | * |
||
| 314 | * This method was used by old MySQL systems |
||
| 315 | * |
||
| 316 | * @link http://php.net/mysql |
||
| 317 | * @author <soren at byu dot edu> |
||
| 318 | * @param string $clear The clear text to hash |
||
| 319 | * @return string Hashed password |
||
| 320 | */ |
||
| 321 | public function hash_mysql($clear) { |
||
| 335 | |||
| 336 | /** |
||
| 337 | * Password hashing method 'my411' |
||
| 338 | * |
||
| 339 | * Uses SHA1 hashs. This method is used by MySQL 4.11 and above |
||
| 340 | * |
||
| 341 | * @param string $clear The clear text to hash |
||
| 342 | * @return string Hashed password |
||
| 343 | */ |
||
| 344 | public function hash_my411($clear) { |
||
| 347 | |||
| 348 | /** |
||
| 349 | * Password hashing method 'kmd5' |
||
| 350 | * |
||
| 351 | * Uses salted MD5 hashs. |
||
| 352 | * |
||
| 353 | * Salt is 2 bytes long, but stored at position 16, so you need to pass at |
||
| 354 | * least 18 bytes. You can pass the crypted hash as salt. |
||
| 355 | * |
||
| 356 | * @param string $clear The clear text to hash |
||
| 357 | * @param string $salt The salt to use, null for random |
||
| 358 | * @return string Hashed password |
||
| 359 | */ |
||
| 360 | public function hash_kmd5($clear, $salt = null) { |
||
| 368 | |||
| 369 | /** |
||
| 370 | * Password stretched hashing wrapper. |
||
| 371 | * |
||
| 372 | * Initial hash is repeatedly rehashed with same password. |
||
| 373 | * Any salted hash algorithm supported by PHP hash() can be used. Salt |
||
| 374 | * is 1+8 bytes long, 1st byte is the iteration count when given. For null |
||
| 375 | * salts $compute is used. |
||
| 376 | * |
||
| 377 | * The actual iteration count is 2 to the power of the given count, |
||
| 378 | * maximum is 30 (-> 2^30 = 1_073_741_824). If a higher one is given, |
||
| 379 | * the function throws an exception. |
||
| 380 | * This iteration count is expected to grow with increasing power of |
||
| 381 | * new computers. |
||
| 382 | * |
||
| 383 | * @author Andreas Gohr <[email protected]> |
||
| 384 | * @author Schplurtz le Déboulonné <[email protected]> |
||
| 385 | * @link http://www.openwall.com/phpass/ |
||
| 386 | * |
||
| 387 | * @param string $algo The hash algorithm to be used |
||
| 388 | * @param string $clear The clear text to hash |
||
| 389 | * @param string $salt The salt to use, null for random |
||
| 390 | * @param string $magic The hash identifier (P or H) |
||
| 391 | * @param int $compute The iteration count for new passwords |
||
| 392 | * @throws \Exception |
||
| 393 | * @return string Hashed password |
||
| 394 | */ |
||
| 395 | protected function stretched_hash($algo, $clear, $salt = null, $magic = 'P', $compute = 8) { |
||
| 440 | |||
| 441 | /** |
||
| 442 | * Password hashing method 'pmd5' |
||
| 443 | * |
||
| 444 | * Repeatedly uses salted MD5 hashs. See stretched_hash() for the |
||
| 445 | * details. |
||
| 446 | * |
||
| 447 | * |
||
| 448 | * @author Schplurtz le Déboulonné <[email protected]> |
||
| 449 | * @link http://www.openwall.com/phpass/ |
||
| 450 | * @see PassHash::stretched_hash() for the implementation details. |
||
| 451 | * |
||
| 452 | * @param string $clear The clear text to hash |
||
| 453 | * @param string $salt The salt to use, null for random |
||
| 454 | * @param string $magic The hash identifier (P or H) |
||
| 455 | * @param int $compute The iteration count for new passwords |
||
| 456 | * @throws Exception |
||
| 457 | * @return string Hashed password |
||
| 458 | */ |
||
| 459 | public function hash_pmd5($clear, $salt = null, $magic = 'P', $compute = 8) { |
||
| 462 | |||
| 463 | /** |
||
| 464 | * Password hashing method 'drupal_sha512' |
||
| 465 | * |
||
| 466 | * Implements Drupal salted sha512 hashs. Drupal truncates the hash at 55 |
||
| 467 | * characters. See stretched_hash() for the details; |
||
| 468 | * |
||
| 469 | * @author Schplurtz le Déboulonné <[email protected]> |
||
| 470 | * @link https://api.drupal.org/api/drupal/includes%21password.inc/7.x |
||
| 471 | * @see PassHash::stretched_hash() for the implementation details. |
||
| 472 | * |
||
| 473 | * @param string $clear The clear text to hash |
||
| 474 | * @param string $salt The salt to use, null for random |
||
| 475 | * @param string $magic The hash identifier (S) |
||
| 476 | * @param int $compute The iteration count for new passwords (defautl is drupal 7's) |
||
| 477 | * @throws Exception |
||
| 478 | * @return string Hashed password |
||
| 479 | */ |
||
| 480 | public function hash_drupal_sha512($clear, $salt = null, $magic = 'S', $compute = 15) { |
||
| 483 | |||
| 484 | /** |
||
| 485 | * Alias for hash_pmd5 |
||
| 486 | * |
||
| 487 | * @param string $clear |
||
| 488 | * @param null|string $salt |
||
| 489 | * @param string $magic |
||
| 490 | * @param int $compute |
||
| 491 | * |
||
| 492 | * @return string |
||
| 493 | * @throws \Exception |
||
| 494 | */ |
||
| 495 | public function hash_hmd5($clear, $salt = null, $magic = 'H', $compute = 8) { |
||
| 498 | |||
| 499 | /** |
||
| 500 | * Password hashing method 'djangosha1' |
||
| 501 | * |
||
| 502 | * Uses salted SHA1 hashs. Salt is 5 bytes long. |
||
| 503 | * This is used by the Django Python framework |
||
| 504 | * |
||
| 505 | * @link http://docs.djangoproject.com/en/dev/topics/auth/#passwords |
||
| 506 | * |
||
| 507 | * @param string $clear The clear text to hash |
||
| 508 | * @param string $salt The salt to use, null for random |
||
| 509 | * @return string Hashed password |
||
| 510 | */ |
||
| 511 | public function hash_djangosha1($clear, $salt = null) { |
||
| 515 | |||
| 516 | /** |
||
| 517 | * Password hashing method 'djangomd5' |
||
| 518 | * |
||
| 519 | * Uses salted MD5 hashs. Salt is 5 bytes long. |
||
| 520 | * This is used by the Django Python framework |
||
| 521 | * |
||
| 522 | * @link http://docs.djangoproject.com/en/dev/topics/auth/#passwords |
||
| 523 | * |
||
| 524 | * @param string $clear The clear text to hash |
||
| 525 | * @param string $salt The salt to use, null for random |
||
| 526 | * @return string Hashed password |
||
| 527 | */ |
||
| 528 | public function hash_djangomd5($clear, $salt = null) { |
||
| 532 | |||
| 533 | /** |
||
| 534 | * Password hashing method 'seafilepbkdf2' |
||
| 535 | * |
||
| 536 | * An algorithm and iteration count should be given in the opts array. |
||
| 537 | * |
||
| 538 | * Hash algorithm is the string that is in the password string in seafile |
||
| 539 | * database. It has to be converted to a php algo name. |
||
| 540 | * |
||
| 541 | * @author Schplurtz le Déboulonné <[email protected]> |
||
| 542 | * @see https://stackoverflow.com/a/23670177 |
||
| 543 | * |
||
| 544 | * @param string $clear The clear text to hash |
||
| 545 | * @param string $salt The salt to use, null for random |
||
| 546 | * @param array $opts ('algo' => hash algorithm, 'iter' => iterations) |
||
| 547 | * @return string Hashed password |
||
| 548 | * @throws Exception when PHP is missing support for the method/algo |
||
| 549 | */ |
||
| 550 | public function hash_seafilepbkdf2($clear, $salt=null, $opts=array()) { |
||
| 573 | |||
| 574 | /** |
||
| 575 | * Password hashing method 'djangopbkdf2' |
||
| 576 | * |
||
| 577 | * An algorithm and iteration count should be given in the opts array. |
||
| 578 | * Defaults to sha256 and 24000 iterations |
||
| 579 | * |
||
| 580 | * @param string $clear The clear text to hash |
||
| 581 | * @param string $salt The salt to use, null for random |
||
| 582 | * @param array $opts ('algo' => hash algorithm, 'iter' => iterations) |
||
| 583 | * @return string Hashed password |
||
| 584 | * @throws \Exception when PHP is missing support for the method/algo |
||
| 585 | */ |
||
| 586 | public function hash_djangopbkdf2($clear, $salt=null, $opts=array()) { |
||
| 608 | |||
| 609 | /** |
||
| 610 | * Alias for djangopbkdf2 defaulting to sha256 as hash algorithm |
||
| 611 | * |
||
| 612 | * @param string $clear The clear text to hash |
||
| 613 | * @param string $salt The salt to use, null for random |
||
| 614 | * @param array $opts ('iter' => iterations) |
||
| 615 | * @return string Hashed password |
||
| 616 | * @throws \Exception when PHP is missing support for the method/algo |
||
| 617 | */ |
||
| 618 | public function hash_djangopbkdf2_sha256($clear, $salt=null, $opts=array()) { |
||
| 622 | |||
| 623 | /** |
||
| 624 | * Alias for djangopbkdf2 defaulting to sha1 as hash algorithm |
||
| 625 | * |
||
| 626 | * @param string $clear The clear text to hash |
||
| 627 | * @param string $salt The salt to use, null for random |
||
| 628 | * @param array $opts ('iter' => iterations) |
||
| 629 | * @return string Hashed password |
||
| 630 | * @throws \Exception when PHP is missing support for the method/algo |
||
| 631 | */ |
||
| 632 | public function hash_djangopbkdf2_sha1($clear, $salt=null, $opts=array()) { |
||
| 636 | |||
| 637 | /** |
||
| 638 | * Passwordhashing method 'bcrypt' |
||
| 639 | * |
||
| 640 | * Uses a modified blowfish algorithm called eksblowfish |
||
| 641 | * This method works on PHP 5.3+ only and will throw an exception |
||
| 642 | * if the needed crypt support isn't available |
||
| 643 | * |
||
| 644 | * A full hash should be given as salt (starting with $a2$) or this |
||
| 645 | * will break. When no salt is given, the iteration count can be set |
||
| 646 | * through the $compute variable. |
||
| 647 | * |
||
| 648 | * @param string $clear The clear text to hash |
||
| 649 | * @param string $salt The salt to use, null for random |
||
| 650 | * @param int $compute The iteration count (between 4 and 31) |
||
| 651 | * @throws \Exception |
||
| 652 | * @return string Hashed password |
||
| 653 | */ |
||
| 654 | public function hash_bcrypt($clear, $salt = null, $compute = 10) { |
||
| 667 | |||
| 668 | /** |
||
| 669 | * Password hashing method SHA512 |
||
| 670 | * |
||
| 671 | * This is only supported on PHP 5.3.2 or higher and will throw an exception if |
||
| 672 | * the needed crypt support is not available |
||
| 673 | * |
||
| 674 | * @param string $clear The clear text to hash |
||
| 675 | * @param string $salt The salt to use, null for random |
||
| 676 | * @param string $magic The rounds for sha512 (for example "rounds=3000"), null for default value |
||
| 677 | * @return string Hashed password |
||
| 678 | * @throws \Exception |
||
| 679 | */ |
||
| 680 | public function hash_sha512($clear, $salt = null, $magic = null) { |
||
| 691 | |||
| 692 | /** |
||
| 693 | * Password hashing method 'mediawiki' |
||
| 694 | * |
||
| 695 | * Uses salted MD5, this is referred to as Method B in MediaWiki docs. Unsalted md5 |
||
| 696 | * method 'A' is not supported. |
||
| 697 | * |
||
| 698 | * @link http://www.mediawiki.org/wiki/Manual_talk:User_table#user_password_column |
||
| 699 | * |
||
| 700 | * @param string $clear The clear text to hash |
||
| 701 | * @param string $salt The salt to use, null for random |
||
| 702 | * @return string Hashed password |
||
| 703 | */ |
||
| 704 | public function hash_mediawiki($clear, $salt = null) { |
||
| 708 | |||
| 709 | |||
| 710 | /** |
||
| 711 | * Password hashing method 'argon2i' |
||
| 712 | * |
||
| 713 | * Uses php's own password_hash function to create argon2i password hash |
||
| 714 | * Default Cost and thread options are used for now. |
||
| 715 | * |
||
| 716 | * @link https://www.php.net/manual/de/function.password-hash.php |
||
| 717 | * |
||
| 718 | * @param string $clear The clear text to hash |
||
| 719 | * @return string Hashed password |
||
| 720 | */ |
||
| 721 | public function hash_argon2i($clear) { |
||
| 727 | |||
| 728 | /** |
||
| 729 | * Password hashing method 'argon2id' |
||
| 730 | * |
||
| 731 | * Uses php's own password_hash function to create argon2id password hash |
||
| 732 | * Default Cost and thread options are used for now. |
||
| 733 | * |
||
| 734 | * @link https://www.php.net/manual/de/function.password-hash.php |
||
| 735 | * |
||
| 736 | * @param string $clear The clear text to hash |
||
| 737 | * @return string Hashed password |
||
| 738 | */ |
||
| 739 | public function hash_argon2id($clear) { |
||
| 745 | |||
| 746 | /** |
||
| 747 | * Wraps around native hash_hmac() or reimplents it |
||
| 748 | * |
||
| 749 | * This is not directly used as password hashing method, and thus isn't callable via the |
||
| 750 | * verify_hash() method. It should be used to create signatures and might be used in other |
||
| 751 | * password hashing methods. |
||
| 752 | * |
||
| 753 | * @see hash_hmac() |
||
| 754 | * @author KC Cloyd |
||
| 755 | * @link http://php.net/manual/en/function.hash-hmac.php#93440 |
||
| 756 | * |
||
| 757 | * @param string $algo Name of selected hashing algorithm (i.e. "md5", "sha256", "haval160,4", |
||
| 758 | * etc..) See hash_algos() for a list of supported algorithms. |
||
| 759 | * @param string $data Message to be hashed. |
||
| 760 | * @param string $key Shared secret key used for generating the HMAC variant of the message digest. |
||
| 761 | * @param bool $raw_output When set to TRUE, outputs raw binary data. FALSE outputs lowercase hexits. |
||
| 762 | * @return string |
||
| 763 | */ |
||
| 764 | public static function hmac($algo, $data, $key, $raw_output = false) { |
||
| 791 | |||
| 792 | /** |
||
| 793 | * Use a secure random generator |
||
| 794 | * |
||
| 795 | * @param int $min |
||
| 796 | * @param int $max |
||
| 797 | * @return int |
||
| 798 | */ |
||
| 799 | protected function random($min, $max){ |
||
| 808 | } |
||
| 809 |
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently.
Both the
$myVarassignment in line 1 and the$higherassignment in line 2 are dead. The first because$myVaris never used and the second because$higheris always overwritten for every possible time line.