From a3184df6d7d969935a72d5809bcf2faf9ff5b234 Mon Sep 17 00:00:00 2001 From: Robert Kaiser Date: Fri, 15 Jul 2022 21:20:17 +0200 Subject: [PATCH] replace deprecated mhash() with hash_mac() --- app/authutils.php-class | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/app/authutils.php-class b/app/authutils.php-class index 447a744..81ae2a7 100755 --- a/app/authutils.php-class +++ b/app/authutils.php-class @@ -372,9 +372,9 @@ class AuthUtils { $time = time(); $rest = is_null($offset)?($time % $valid_seconds):intval($offset); // T0, will be sent as part of code to make it valid for the full duration. $counter = floor(($time - $rest) / $valid_seconds); - $hmac = mhash(MHASH_SHA1, $counter, $session['id'].$session['sesskey']); - $offset = hexdec(substr(bin2hex(substr($hmac, -1)), -1)); // Get the last 4 bits as a number. - $totp = hexdec(bin2hex(substr($hmac, $offset, 4))) & 0x7FFFFFFF; // Take 4 bytes at the offset, discard highest bit. + $hmac_hex = hash_hmac('sha1', $counter, $session['id'].$session['sesskey']); + $offset = hexdec(substr($hmac_hex, -1)); // Get the last 4 bits as a number. + $totp = hexdec(substr($hmac_hex, $offset, 8)) & 0x7FFFFFFF; // Take 4 bytes (8 hex chars) at the offset, discard highest bit. $totp_value = sprintf('%0'.$code_digits.'d', substr($totp, -$code_digits)); return $rest.'.'.$totp_value; } -- 2.43.0