<?php

/**
 * Password hasher and verifier.
 *
 * For PHP 5.5 and above it will use the excellent password_hash function with strong salt.
 * For versions below, it will fall back to a custom crypt() call that is only forwards
 * compatible - that is, you can verify old-version passwords with new version, but not vice versa.
 *
 */

namespace Anano\Crypto;

class Hash
{
    public static function make($password)
    {
        if (function_exists('password_hash'))
        {
            return password_hash($password, PASSWORD_BCRYPT);
        }
        else
        {
            $salt = '$2a$10$' . substr( md5(microtime(true)) , 0, 22);
            return crypt($password, $salt);
        }
    }

    public static function verify($password, $hash)
    {
        if (function_exists('password_hash'))
        {
            return password_verify($password, $hash);
        }
        else
        {
            $salt = '$2a$10$' . substr($hash, 7, 22);
            return $hash === crypt($password, $salt);
        }
    }
}

<?php

/**
 * Password hasher and verifier.
 *
 * For PHP 5.5 and above it will use the excellent blowfish encryption. For 5.4.* and below it
 * will fall back to the much worse crypt() function with random salt.
 *
 * In an attempt to make it slightly more secure, the fallback hash double-encrypts the password,
 * including both a crypt and a crypt of the SHA1 of the password. But I'm no cryptographer, I
 * honestly don't know how much difference it makes.
 *
 * Remember when porting the site that passwords generated on PHP <=5.4 will not work on >=5.5
 * and vice versa.
 */

namespace Anano\Crypto;

class Hash
{
    public static function make($password)
    {
        if (function_exists('password_hash'))
        {
            return password_hash($password, PASSWORD_BCRYPT);
        }
        else
        {
            $salt = substr( md5(microtime(true)) , 0, 16);
            return self::hash($password, $salt);
        }
    }
    
    public static function verify($password, $hash)
    {
        if (function_exists('password_hash'))
        {
            return password_verify($password, $hash);
        }
        else
        {
            $salt = substr($hash, 0, 16);
            return $hash === self::hash($password, $salt);
        }
    }
    
    private static function hash($password, $salt)
    {
        $hash = crypt($password, $salt) . crypt(sha1($password . $salt), $salt);
        return $salt.$hash;
    }
}
Revert "Fix to hash class"
Revert "Fix to hash class"

This reverts commit 6a44d9530f1c973a2ad2deb3eb133b5289e4bcb3.
