diff --git a/application/Espo/Core/Authentication/Logins/Hmac.php b/application/Espo/Core/Authentication/Logins/Hmac.php index 366048a106..a0e3ad2438 100644 --- a/application/Espo/Core/Authentication/Logins/Hmac.php +++ b/application/Espo/Core/Authentication/Logins/Hmac.php @@ -71,12 +71,11 @@ class Hmac implements Login $string = $request->getMethod() . ' ' . $request->getResourcePath(); // As of v8.4.1. - if ($hash === hash_hmac('sha256', $string, $secretKey)) { + if ($hash === ApiKey::hash($secretKey, $string)) { return Result::success($user); } - // To become a legacy. - if ($hash === ApiKey::hash($secretKey, $string)) { + if ($hash === ApiKey::hashLegacy($secretKey, $string)) { return Result::success($user); } diff --git a/application/Espo/Core/Utils/ApiKey.php b/application/Espo/Core/Utils/ApiKey.php index 1faaf7610f..3fe83b792f 100644 --- a/application/Espo/Core/Utils/ApiKey.php +++ b/application/Espo/Core/Utils/ApiKey.php @@ -39,6 +39,15 @@ class ApiKey {} public static function hash(string $secretKey, string $string = ''): string + { + return hash_hmac('sha256', $string, $secretKey); + } + + /** + * @deprecated + * @internal + */ + public static function hashLegacy(string $secretKey, string $string = ''): string { return hash_hmac('sha256', $string, $secretKey, true); }