auth changes

application/Espo/Core/Utils/ApiKey.php

@@ -43,9 +43,9 @@ class ApiKey
         return $this->config;
     }
 
-    public static function hash($secretKey)
+    public static function hash($secretKey, $string = '')
     {
-        return hash_hmac('sha256', '', $secretKey, true);
+        return hash_hmac('sha256', $string, $secretKey, true);
     }
 
     public function getSecretKeyForUserId($id)

application/Espo/Core/Utils/Auth.php

@@ -193,7 +193,11 @@ class Auth
 
         $authentication = $this->getAuthentication($authenticationMethod);
 
-        $user = $authentication->login($username, $password, $authToken, $this->isPortal());
+        $params = [
+            'isPortal' => $this->isPortal()
+        ];
+
+        $user = $authentication->login($username, $password, $authToken, $params, $this->request);
 
         $authLogRecord = null;
 

application/Espo/Core/Utils/Authentication/Espo.php

@@ -33,7 +33,7 @@ use \Espo\Core\Exceptions\Error;
 
 class Espo extends Base
 {
-    public function login($username, $password, \Espo\Entities\AuthToken $authToken = null, $isPortal = null)
+    public function login($username, $password, \Espo\Entities\AuthToken $authToken = null, $params = [], $request)
     {
         if (!$password) return;
 
@@ -43,12 +43,12 @@ class Espo extends Base
             $hash = $this->getPasswordHash()->hash($password);
         }
 
-        $user = $this->getEntityManager()->getRepository('User')->findOne(array(
-            'whereClause' => array(
+        $user = $this->getEntityManager()->getRepository('User')->findOne([
+            'whereClause' => [
                 'userName' => $username,
                 'password' => $hash
-            )
-        ));
+            ]
+        ]);
 
         return $user;
     }

application/Espo/Core/Utils/Authentication/Hmac.php

@@ -33,7 +33,7 @@ use \Espo\Core\Exceptions\Error;
 
 class Hmac extends Base
 {
-    public function login($username, $password, $authToken = null, $isPortal = null)
+    public function login($username, $password, $authToken = null, $params = [], $request)
     {
         $apiKey = $username;
         $hash = $password;
@@ -52,7 +52,9 @@ class Hmac extends Base
             $secretKey = $apiKeyUtil->getSecretKeyForUserId($user->id);
             if (!$secretKey) return;
 
-            if ($hash === \Espo\Core\Utils\ApiKey::hash($secretKey)) {
+            $string = $request->getMethod() . ' ' . $request->getResourceUri();
+
+            if ($hash === \Espo\Core\Utils\ApiKey::hash($secretKey, $string)) {
                 return $user;
             }
 

application/Espo/Core/Utils/Authentication/LDAP.php

@@ -110,10 +110,12 @@ class LDAP extends Espo
      *
      * @return \Espo\Entities\User | null
      */
-    public function login($username, $password, \Espo\Entities\AuthToken $authToken = null, $isPortal = null)
+    public function login($username, $password, \Espo\Entities\AuthToken $authToken = null, $params = [], $request)
     {
         if (!$password) return;
 
+        $isPortal = !empty($params['isPortal']);
+
         if ($authToken) {
             return $this->loginByToken($username, $authToken);
         }