From d9faf23b81cf4e3db36f3110a1a42dae86bf0493 Mon Sep 17 00:00:00 2001
From: Yuri Kuznetsov <yurikuzn@users.noreply.github.com>
Date: Sun, 24 Nov 2024 11:23:32 +0200
Subject: [PATCH] ref

---
 application/Espo/Core/Authentication/Logins/Hmac.php | 5 ++---
 application/Espo/Core/Utils/ApiKey.php               | 9 +++++++++
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/application/Espo/Core/Authentication/Logins/Hmac.php b/application/Espo/Core/Authentication/Logins/Hmac.php
index 366048a106..a0e3ad2438 100644
--- a/application/Espo/Core/Authentication/Logins/Hmac.php
+++ b/application/Espo/Core/Authentication/Logins/Hmac.php
@@ -71,12 +71,11 @@ class Hmac implements Login
         $string = $request->getMethod() . ' ' . $request->getResourcePath();
 
         // As of v8.4.1.
-        if ($hash === hash_hmac('sha256', $string, $secretKey)) {
+        if ($hash === ApiKey::hash($secretKey, $string)) {
             return Result::success($user);
         }
 
-        // To become a legacy.
-        if ($hash === ApiKey::hash($secretKey, $string)) {
+        if ($hash === ApiKey::hashLegacy($secretKey, $string)) {
             return Result::success($user);
         }
 
diff --git a/application/Espo/Core/Utils/ApiKey.php b/application/Espo/Core/Utils/ApiKey.php
index 1faaf7610f..3fe83b792f 100644
--- a/application/Espo/Core/Utils/ApiKey.php
+++ b/application/Espo/Core/Utils/ApiKey.php
@@ -39,6 +39,15 @@ class ApiKey
     {}
 
     public static function hash(string $secretKey, string $string = ''): string
+    {
+        return hash_hmac('sha256', $string, $secretKey);
+    }
+
+    /**
+     * @deprecated
+     * @internal
+     */
+    public static function hashLegacy(string $secretKey, string $string = ''): string
     {
         return hash_hmac('sha256', $string, $secretKey, true);
     }