From 8cffb479fa52a8e83e8817d792d0ca4020d91598 Mon Sep 17 00:00:00 2001
From: Zankaria <zankaria.auxa@mailu.io>
Date: Wed, 16 Apr 2025 14:38:07 +0200
Subject: [PATCH] functions.php: use secure_hash where appropriate

---
 inc/functions.php | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/inc/functions.php b/inc/functions.php
index def00287..a37e2001 100644
--- a/inc/functions.php
+++ b/inc/functions.php
@@ -11,6 +11,7 @@ if (realpath($_SERVER['SCRIPT_FILENAME']) == str_replace('\\', '/', __FILE__)) {
 
 $microtime_start = microtime(true);
 
+use Vichan\Functions\Hide;
 use Lifo\IP\IP; // for expanding IPv6 address in DNSBL()
 
 // the user is not currently logged in as a moderator
@@ -1691,7 +1692,7 @@ function checkSpam(array $extra_salt = array()) {
         $_hash = sha1($_hash . $extra_salt);
 
         if ($hash != $_hash) {
-                return true;
+            return true;
         }
 
         $query = prepare('SELECT `passed` FROM ``antispam`` WHERE `hash` = :hash');
@@ -2583,11 +2584,11 @@ function rrmdir($dir) {
 function poster_id($ip, $thread) {
 	global $config;
 
-	if ($id = event('poster-id', $ip, $thread))
+	if ($id = event('poster-id', $ip, $thread)) {
 		return $id;
+	}
 
-	// Confusing, hard to brute-force, but simple algorithm
-	return substr(sha1(sha1($ip . $config['secure_trip_salt'] . $thread) . $config['secure_trip_salt']), 0, $config['poster_id_length']);
+	return \substr(Hide\secure_hash($ip . $config['secure_trip_salt'] . $thread . $config['secure_trip_salt'], false), 0, $config['poster_id_length']);
 }
 
 function generate_tripcode($name) {
@@ -2615,7 +2616,7 @@ function generate_tripcode($name) {
 		if (isset($config['custom_tripcode']["##{$trip}"]))
 			$trip = $config['custom_tripcode']["##{$trip}"];
 		else
-			$trip = '!!' . substr(crypt($trip, str_replace('+', '.', '_..A.' . substr(base64_encode(sha1($trip . $config['secure_trip_salt'], true)), 0, 4))), -10);
+			$trip = '!!' . substr(crypt($trip, str_replace('+', '.', '_..A.' . substr(Hide\secure_hash($trip . $config['secure_trip_salt'], false), 0, 4))), -10);
 	} else {
 		if (isset($config['custom_tripcode']["#{$trip}"]))
 			$trip = $config['custom_tripcode']["#{$trip}"];