From 78b548628ca29e5f47c201fbadfcca1c81ad3133 Mon Sep 17 00:00:00 2001
From: Sadie Powell <sadie@witchery.services>
Date: Sun, 15 Dec 2024 13:23:31 +0000
Subject: [PATCH] Add example code for how to validate SHA2 passwords in PHP.

---
 modules/encryption/enc_sha2.cpp | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/modules/encryption/enc_sha2.cpp b/modules/encryption/enc_sha2.cpp
index d2ad99b62..5172f64cc 100644
--- a/modules/encryption/enc_sha2.cpp
+++ b/modules/encryption/enc_sha2.cpp
@@ -171,6 +171,21 @@ public:
 			if (bpos == Anope::string::npos)
 				return; // No HMAC key.
 
+			// If you are using PHP you can validate passwords like this:
+			//
+			// <?php
+			// function check_pass($user_pass, $anope_pass) {
+			// 	[$algo, $hash, $key] = explode(':', $anope_pass);
+			// 	$hash_algo           = substr($algo, 5);
+			// 	$unhex_key           = hex2bin($key);
+			// 	$user_hash           = hash_hmac($hash_algo, $user_pass, $unhex_key);
+			// 	return hash_equals($hash, $user_hash);
+			// }
+			//
+			// $anope_pass  = "hmac-sha256:5f7f039818f6e10be84dab0f49610a387d3818b2c883eacdc1778c66a7cecf3b:1a924a3b05a11d7bf3c752d820391dbe01fb7e5d83f7400765de987c3fbb0ec3";
+			// var_dump(check_pass("test12345", $anope_pass));     // valid
+			// var_dump(check_pass("test123456789", $anope_pass)); // invalid
+
 			Anope::string pass_hex(nc->pass.begin() + apos + 1, nc->pass.begin() + bpos);
 			Anope::string key_hex(nc->pass.begin() + bpos + 1, nc->pass.end());
 			Anope::string key;