splitbrain /
dokuwiki
Complex classes like PassHash often do a lot of different things. To break such a class down, we need to identify a cohesive component within that class. A common approach to find such a component is to look for fields/methods that share the same prefixes, or suffixes. You can also have a look at the cohesion graph to spot any un-connected, or weakly-connected components.
Once you have determined the fields that belong together, you can apply the Extract Class refactoring. If the component makes sense as a sub-class, Extract Subclass is also a candidate, and is often faster.
While breaking up the class, it is a good idea to analyze how other classes use PassHash, and based on these observations, apply Extract Interface, too.
| 1 | <?php |
||
| 14 | class PassHash { |
||
| 15 | /** |
||
| 16 | * Verifies a cleartext password against a crypted hash |
||
| 17 | * |
||
| 18 | * The method and salt used for the crypted hash is determined automatically, |
||
| 19 | * then the clear text password is crypted using the same method. If both hashs |
||
| 20 | * match true is is returned else false |
||
| 21 | * |
||
| 22 | * @author Andreas Gohr <[email protected]> |
||
| 23 | * |
||
| 24 | * @param string $clear Clear-Text password |
||
| 25 | * @param string $hash Hash to compare against |
||
| 26 | * @return bool |
||
| 27 | */ |
||
| 28 | public function verify_hash($clear, $hash) { |
||
| 109 | |||
| 110 | /** |
||
| 111 | * Create a random salt |
||
| 112 | * |
||
| 113 | * @param int $len The length of the salt |
||
| 114 | * @return string |
||
| 115 | */ |
||
| 116 | public function gen_salt($len = 32) { |
||
| 124 | |||
| 125 | /** |
||
| 126 | * Initialize the passed variable with a salt if needed. |
||
| 127 | * |
||
| 128 | * If $salt is not null, the value is kept, but the lenght restriction is |
||
| 129 | * applied (unless, $cut is false). |
||
| 130 | * |
||
| 131 | * @param string|null &$salt The salt, pass null if you want one generated |
||
| 132 | * @param int $len The length of the salt |
||
| 133 | * @param bool $cut Apply length restriction to existing salt? |
||
| 134 | */ |
||
| 135 | public function init_salt(&$salt, $len = 32, $cut = true) { |
||
| 142 | |||
| 143 | // Password hashing methods follow below |
||
| 144 | |||
| 145 | /** |
||
| 146 | * Password hashing method 'smd5' |
||
| 147 | * |
||
| 148 | * Uses salted MD5 hashs. Salt is 8 bytes long. |
||
| 149 | * |
||
| 150 | * The same mechanism is used by Apache's 'apr1' method. This will |
||
| 151 | * fallback to a implementation in pure PHP if MD5 support is not |
||
| 152 | * available in crypt() |
||
| 153 | * |
||
| 154 | * @author Andreas Gohr <[email protected]> |
||
| 155 | * @author <mikey_nich at hotmail dot com> |
||
| 156 | * @link http://php.net/manual/en/function.crypt.php#73619 |
||
| 157 | * |
||
| 158 | * @param string $clear The clear text to hash |
||
| 159 | * @param string $salt The salt to use, null for random |
||
| 160 | * @return string Hashed password |
||
| 161 | */ |
||
| 162 | public function hash_smd5($clear, $salt = null) { |
||
| 172 | |||
| 173 | /** |
||
| 174 | * Password hashing method 'lsmd5' |
||
| 175 | * |
||
| 176 | * Uses salted MD5 hashs. Salt is 8 bytes long. |
||
| 177 | * |
||
| 178 | * This is the format used by LDAP. |
||
| 179 | * |
||
| 180 | * @param string $clear The clear text to hash |
||
| 181 | * @param string $salt The salt to use, null for random |
||
| 182 | * @return string Hashed password |
||
| 183 | */ |
||
| 184 | public function hash_lsmd5($clear, $salt = null) { |
||
| 188 | |||
| 189 | /** |
||
| 190 | * Password hashing method 'apr1' |
||
| 191 | * |
||
| 192 | * Uses salted MD5 hashs. Salt is 8 bytes long. |
||
| 193 | * |
||
| 194 | * This is basically the same as smd1 above, but as used by Apache. |
||
| 195 | * |
||
| 196 | * @author <mikey_nich at hotmail dot com> |
||
| 197 | * @link http://php.net/manual/en/function.crypt.php#73619 |
||
| 198 | * |
||
| 199 | * @param string $clear The clear text to hash |
||
| 200 | * @param string $salt The salt to use, null for random |
||
| 201 | * @param string $magic The hash identifier (apr1 or 1) |
||
| 202 | * @return string Hashed password |
||
| 203 | */ |
||
| 204 | public function hash_apr1($clear, $salt = null, $magic = 'apr1') { |
||
| 239 | |||
| 240 | /** |
||
| 241 | * Password hashing method 'md5' |
||
| 242 | * |
||
| 243 | * Uses MD5 hashs. |
||
| 244 | * |
||
| 245 | * @param string $clear The clear text to hash |
||
| 246 | * @return string Hashed password |
||
| 247 | */ |
||
| 248 | public function hash_md5($clear) { |
||
| 251 | |||
| 252 | /** |
||
| 253 | * Password hashing method 'sha1' |
||
| 254 | * |
||
| 255 | * Uses SHA1 hashs. |
||
| 256 | * |
||
| 257 | * @param string $clear The clear text to hash |
||
| 258 | * @return string Hashed password |
||
| 259 | */ |
||
| 260 | public function hash_sha1($clear) { |
||
| 263 | |||
| 264 | /** |
||
| 265 | * Password hashing method 'ssha' as used by LDAP |
||
| 266 | * |
||
| 267 | * Uses salted SHA1 hashs. Salt is 4 bytes long. |
||
| 268 | * |
||
| 269 | * @param string $clear The clear text to hash |
||
| 270 | * @param string $salt The salt to use, null for random |
||
| 271 | * @return string Hashed password |
||
| 272 | */ |
||
| 273 | public function hash_ssha($clear, $salt = null) { |
||
| 277 | |||
| 278 | /** |
||
| 279 | * Password hashing method 'crypt' |
||
| 280 | * |
||
| 281 | * Uses salted crypt hashs. Salt is 2 bytes long. |
||
| 282 | * |
||
| 283 | * @param string $clear The clear text to hash |
||
| 284 | * @param string $salt The salt to use, null for random |
||
| 285 | * @return string Hashed password |
||
| 286 | */ |
||
| 287 | public function hash_crypt($clear, $salt = null) { |
||
| 291 | |||
| 292 | /** |
||
| 293 | * Password hashing method 'mysql' |
||
| 294 | * |
||
| 295 | * This method was used by old MySQL systems |
||
| 296 | * |
||
| 297 | * @link http://php.net/mysql |
||
| 298 | * @author <soren at byu dot edu> |
||
| 299 | * @param string $clear The clear text to hash |
||
| 300 | * @return string Hashed password |
||
| 301 | */ |
||
| 302 | public function hash_mysql($clear) { |
||
| 316 | |||
| 317 | /** |
||
| 318 | * Password hashing method 'my411' |
||
| 319 | * |
||
| 320 | * Uses SHA1 hashs. This method is used by MySQL 4.11 and above |
||
| 321 | * |
||
| 322 | * @param string $clear The clear text to hash |
||
| 323 | * @return string Hashed password |
||
| 324 | */ |
||
| 325 | public function hash_my411($clear) { |
||
| 328 | |||
| 329 | /** |
||
| 330 | * Password hashing method 'kmd5' |
||
| 331 | * |
||
| 332 | * Uses salted MD5 hashs. |
||
| 333 | * |
||
| 334 | * Salt is 2 bytes long, but stored at position 16, so you need to pass at |
||
| 335 | * least 18 bytes. You can pass the crypted hash as salt. |
||
| 336 | * |
||
| 337 | * @param string $clear The clear text to hash |
||
| 338 | * @param string $salt The salt to use, null for random |
||
| 339 | * @return string Hashed password |
||
| 340 | */ |
||
| 341 | public function hash_kmd5($clear, $salt = null) { |
||
| 349 | |||
| 350 | /** |
||
| 351 | * Password hashing method 'pmd5' |
||
| 352 | * |
||
| 353 | * Uses salted MD5 hashs. Salt is 1+8 bytes long, 1st byte is the |
||
| 354 | * iteration count when given, for null salts $compute is used. |
||
| 355 | * |
||
| 356 | * The actual iteration count is the given count squared, maximum is |
||
| 357 | * 30 (-> 1073741824). If a higher one is given, the function throws |
||
| 358 | * an exception. |
||
| 359 | * |
||
| 360 | * @link http://www.openwall.com/phpass/ |
||
| 361 | * |
||
| 362 | * @param string $clear The clear text to hash |
||
| 363 | * @param string $salt The salt to use, null for random |
||
| 364 | * @param string $magic The hash identifier (P or H) |
||
| 365 | * @param int $compute The iteration count for new passwords |
||
| 366 | * @throws \Exception |
||
| 367 | * @return string Hashed password |
||
| 368 | */ |
||
| 369 | public function hash_pmd5($clear, $salt = null, $magic = 'P', $compute = 8) { |
||
| 414 | |||
| 415 | /** |
||
| 416 | * Alias for hash_pmd5 |
||
| 417 | * |
||
| 418 | * @param string $clear |
||
| 419 | * @param null|string $salt |
||
| 420 | * @param string $magic |
||
| 421 | * @param int $compute |
||
| 422 | * |
||
| 423 | * @return string |
||
| 424 | * @throws \Exception |
||
| 425 | */ |
||
| 426 | public function hash_hmd5($clear, $salt = null, $magic = 'H', $compute = 8) { |
||
| 429 | |||
| 430 | /** |
||
| 431 | * Password hashing method 'djangosha1' |
||
| 432 | * |
||
| 433 | * Uses salted SHA1 hashs. Salt is 5 bytes long. |
||
| 434 | * This is used by the Django Python framework |
||
| 435 | * |
||
| 436 | * @link http://docs.djangoproject.com/en/dev/topics/auth/#passwords |
||
| 437 | * |
||
| 438 | * @param string $clear The clear text to hash |
||
| 439 | * @param string $salt The salt to use, null for random |
||
| 440 | * @return string Hashed password |
||
| 441 | */ |
||
| 442 | public function hash_djangosha1($clear, $salt = null) { |
||
| 446 | |||
| 447 | /** |
||
| 448 | * Password hashing method 'djangomd5' |
||
| 449 | * |
||
| 450 | * Uses salted MD5 hashs. Salt is 5 bytes long. |
||
| 451 | * This is used by the Django Python framework |
||
| 452 | * |
||
| 453 | * @link http://docs.djangoproject.com/en/dev/topics/auth/#passwords |
||
| 454 | * |
||
| 455 | * @param string $clear The clear text to hash |
||
| 456 | * @param string $salt The salt to use, null for random |
||
| 457 | * @return string Hashed password |
||
| 458 | */ |
||
| 459 | public function hash_djangomd5($clear, $salt = null) { |
||
| 463 | |||
| 464 | /** |
||
| 465 | * Password hashing method 'djangopbkdf2' |
||
| 466 | * |
||
| 467 | * An algorithm and iteration count should be given in the opts array. |
||
| 468 | * Defaults to sha256 and 24000 iterations |
||
| 469 | * |
||
| 470 | * @param string $clear The clear text to hash |
||
| 471 | * @param string $salt The salt to use, null for random |
||
| 472 | * @param array $opts ('algo' => hash algorithm, 'iter' => iterations) |
||
| 473 | * @return string Hashed password |
||
| 474 | * @throws \Exception when PHP is missing support for the method/algo |
||
| 475 | */ |
||
| 476 | public function hash_djangopbkdf2($clear, $salt=null, $opts=array()) { |
||
| 498 | |||
| 499 | /** |
||
| 500 | * Alias for djangopbkdf2 defaulting to sha256 as hash algorithm |
||
| 501 | * |
||
| 502 | * @param string $clear The clear text to hash |
||
| 503 | * @param string $salt The salt to use, null for random |
||
| 504 | * @param array $opts ('iter' => iterations) |
||
| 505 | * @return string Hashed password |
||
| 506 | * @throws \Exception when PHP is missing support for the method/algo |
||
| 507 | */ |
||
| 508 | public function hash_djangopbkdf2_sha256($clear, $salt=null, $opts=array()) { |
||
| 512 | |||
| 513 | /** |
||
| 514 | * Alias for djangopbkdf2 defaulting to sha1 as hash algorithm |
||
| 515 | * |
||
| 516 | * @param string $clear The clear text to hash |
||
| 517 | * @param string $salt The salt to use, null for random |
||
| 518 | * @param array $opts ('iter' => iterations) |
||
| 519 | * @return string Hashed password |
||
| 520 | * @throws \Exception when PHP is missing support for the method/algo |
||
| 521 | */ |
||
| 522 | public function hash_djangopbkdf2_sha1($clear, $salt=null, $opts=array()) { |
||
| 526 | |||
| 527 | /** |
||
| 528 | * Passwordhashing method 'bcrypt' |
||
| 529 | * |
||
| 530 | * Uses a modified blowfish algorithm called eksblowfish |
||
| 531 | * This method works on PHP 5.3+ only and will throw an exception |
||
| 532 | * if the needed crypt support isn't available |
||
| 533 | * |
||
| 534 | * A full hash should be given as salt (starting with $a2$) or this |
||
| 535 | * will break. When no salt is given, the iteration count can be set |
||
| 536 | * through the $compute variable. |
||
| 537 | * |
||
| 538 | * @param string $clear The clear text to hash |
||
| 539 | * @param string $salt The salt to use, null for random |
||
| 540 | * @param int $compute The iteration count (between 4 and 31) |
||
| 541 | * @throws \Exception |
||
| 542 | * @return string Hashed password |
||
| 543 | */ |
||
| 544 | public function hash_bcrypt($clear, $salt = null, $compute = 10) { |
||
| 557 | |||
| 558 | /** |
||
| 559 | * Password hashing method SHA512 |
||
| 560 | * |
||
| 561 | * This is only supported on PHP 5.3.2 or higher and will throw an exception if |
||
| 562 | * the needed crypt support is not available |
||
| 563 | * |
||
| 564 | * @param string $clear The clear text to hash |
||
| 565 | * @param string $salt The salt to use, null for random |
||
| 566 | * @param string $magic The rounds for sha512 (for example "rounds=3000"), null for default value |
||
| 567 | * @return string Hashed password |
||
| 568 | * @throws \Exception |
||
| 569 | */ |
||
| 570 | public function hash_sha512($clear, $salt = null, $magic = null) { |
||
| 581 | |||
| 582 | /** |
||
| 583 | * Password hashing method 'mediawiki' |
||
| 584 | * |
||
| 585 | * Uses salted MD5, this is referred to as Method B in MediaWiki docs. Unsalted md5 |
||
| 586 | * method 'A' is not supported. |
||
| 587 | * |
||
| 588 | * @link http://www.mediawiki.org/wiki/Manual_talk:User_table#user_password_column |
||
| 589 | * |
||
| 590 | * @param string $clear The clear text to hash |
||
| 591 | * @param string $salt The salt to use, null for random |
||
| 592 | * @return string Hashed password |
||
| 593 | */ |
||
| 594 | public function hash_mediawiki($clear, $salt = null) { |
||
| 598 | |||
| 599 | |||
| 600 | /** |
||
| 601 | * Password hashing method 'argon2i' |
||
| 602 | * |
||
| 603 | * Uses php's own password_hash function to create argon2i password hash |
||
| 604 | * Default Cost and thread options are used for now. |
||
| 605 | * |
||
| 606 | * @link https://www.php.net/manual/de/function.password-hash.php |
||
| 607 | * |
||
| 608 | * @param string $clear The clear text to hash |
||
| 609 | * @return string Hashed password |
||
| 610 | */ |
||
| 611 | public function hash_argon2i($clear) { |
||
| 617 | |||
| 618 | /** |
||
| 619 | * Password hashing method 'argon2id' |
||
| 620 | * |
||
| 621 | * Uses php's own password_hash function to create argon2id password hash |
||
| 622 | * Default Cost and thread options are used for now. |
||
| 623 | * |
||
| 624 | * @link https://www.php.net/manual/de/function.password-hash.php |
||
| 625 | * |
||
| 626 | * @param string $clear The clear text to hash |
||
| 627 | * @return string Hashed password |
||
| 628 | */ |
||
| 629 | public function hash_argon2id($clear) { |
||
| 635 | |||
| 636 | /** |
||
| 637 | * Wraps around native hash_hmac() or reimplents it |
||
| 638 | * |
||
| 639 | * This is not directly used as password hashing method, and thus isn't callable via the |
||
| 640 | * verify_hash() method. It should be used to create signatures and might be used in other |
||
| 641 | * password hashing methods. |
||
| 642 | * |
||
| 643 | * @see hash_hmac() |
||
| 644 | * @author KC Cloyd |
||
| 645 | * @link http://php.net/manual/en/function.hash-hmac.php#93440 |
||
| 646 | * |
||
| 647 | * @param string $algo Name of selected hashing algorithm (i.e. "md5", "sha256", "haval160,4", |
||
| 648 | * etc..) See hash_algos() for a list of supported algorithms. |
||
| 649 | * @param string $data Message to be hashed. |
||
| 650 | * @param string $key Shared secret key used for generating the HMAC variant of the message digest. |
||
| 651 | * @param bool $raw_output When set to TRUE, outputs raw binary data. FALSE outputs lowercase hexits. |
||
| 652 | * @return string |
||
| 653 | */ |
||
| 654 | public static function hmac($algo, $data, $key, $raw_output = false) { |
||
| 681 | |||
| 682 | /** |
||
| 683 | * Use a secure random generator |
||
| 684 | * |
||
| 685 | * @param int $min |
||
| 686 | * @param int $max |
||
| 687 | * @return int |
||
| 688 | */ |
||
| 689 | protected function random($min, $max){ |
||
| 698 | } |
||
| 699 |
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently.
Both the
$myVarassignment in line 1 and the$higherassignment in line 2 are dead. The first because$myVaris never used and the second because$higheris always overwritten for every possible time line.