Generates random passwords and validation codes in SMF\Security

Signed-off-by: Jon Stovell <jonstovell@gmail.com>

Author: Sesquipedalian

Sources/Actions/Admin/Members.php

@@ -28,6 +28,7 @@
 use SMF\Logging;
 use SMF\Mail;
 use SMF\Menu;
+use SMF\Security;
 use SMF\Theme;
 use SMF\Time;
 use SMF\User;
@@ -1245,7 +1246,7 @@ public function approve(): void
 			// We have to do this for each member I'm afraid.
 			foreach ($member_info as $member) {
 				// Generate a random activation code.
-				$validation_code = User::generateValidationCode();
+				$validation_code = Security::generateValidationCode();
 
 				// Set these members for activation - I know this includes two id_member checks but it's safer than bodging $condition ;).
 				Db::$db->query(

Sources/Actions/Register2.php

@@ -494,12 +494,12 @@ public static function registerMember(array &$reg_options, bool $return_errors =
 		$validation_code = '';
 
 		if ($reg_options['require'] == 'activation') {
-			$validation_code = User::generateValidationCode();
+			$validation_code = Security::generateValidationCode();
 		}
 
 		// If you haven't put in a password generate one.
 		if ($reg_options['interface'] == 'admin' && $reg_options['password'] == '') {
-			$reg_options['password'] = User::generateValidationCode();
+			$reg_options['password'] = Security::generatePassword();
 			$reg_options['password_check'] = $reg_options['password'];
 		}
 		// Does the first password match the second?

Sources/Actions/Reminder.php

@@ -150,7 +150,7 @@ public function pickType(): ?string
 		// If they have no secret question then they can only get emailed the item, or they are requesting the email, send them an email.
 		if (empty($this->member->secret_question) || (isset($_POST['reminder_type']) && $_POST['reminder_type'] == 'email')) {
 			// Randomly generate a validation code with a max length of 10 chars.
-			$code = User::generateValidationCode();
+			$code = Security::generateValidationCode();
 
 			$replacements = [
 				'REALNAME' => $this->member->name,

Sources/Profile.php

@@ -460,7 +460,7 @@ public function loadStandardFields(bool $force_reload = false)
 
 					// Do they need to revalidate? If so schedule the function!
 					if ($isValid === true && !empty(Config::$modSettings['send_validation_onChange']) && !User::$me->allowedTo('moderate_forum')) {
-						$this->new_data['validation_code'] = User::generateValidationCode();
+						$this->new_data['validation_code'] = Security::generateValidationCode();
 
 						$this->new_data['is_activated'] = User::UNVALIDATED;
 
@@ -2998,7 +2998,7 @@ protected function resetPassword(?string $username = null): void
 		}
 
 		// Generate a random password.
-		$new_password = implode('-', str_split(substr(preg_replace('/\W/', '', base64_encode(random_bytes(18))), 0, 18), 6));
+		$new_password = Security::generatePassword();
 		$new_password_hashed = Security::hashPassword($new_password);
 
 		// Do some checks on the username if needed.

Sources/Security.php

@@ -73,6 +73,31 @@ public static function hashBenchmark(float $hashTime = 0.2): int
 		return $cost;
 	}
 
+	/**
+	 * Generates a random password.
+	 *
+	 * @return string A random password.
+	 */
+	public static function generatePassword(): string
+	{
+		$password = implode('-', str_split(substr(preg_replace('/\W/', '', base64_encode(random_bytes(18))), 0, 18), 6));
+
+		// Maybe a mod wants to do something different?
+		IntegrationHook::call('integrate_generate_password', [&$password]);
+
+		return $password;
+	}
+
+	/**
+	 * Generate a random validation code.
+	 *
+	 * @return string A random validation code
+	 */
+	public static function generateValidationCode(): string
+	{
+		return bin2hex(random_bytes(5));
+	}
+
 	/**
 	 * Check if a specific confirm parameter was given.
 	 *

Sources/Subs-Compat.php

@@ -8823,6 +8823,16 @@ function memoryReturnBytes(string $val): int
 	 * Begin SMF\Security
 	 ********************/
 
+	/**
+	 * Generate a random validation code.
+	 *
+	 * @return string A random validation code
+	 */
+	function generateValidationCode(): string
+	{
+		return SMF\Security::generateValidationCode();
+	}
+
 	/**
 	 * Hashes the user's password
 	 *
@@ -10500,16 +10510,6 @@ function getGroupsWithPermissions(
 		return SMF\User::getGroupsWithPermissions($general_permissions, $board_permissions, $profile_id);
 	}
 
-	/**
-	 * Generate a random validation code.
-	 *
-	 * @return string A random validation code
-	 */
-	function generateValidationCode(): string
-	{
-		return SMF\User::generateValidationCode();
-	}
-
 	/**
 	 * Log the spider presence online.
 	 *

Sources/User.php

@@ -4258,16 +4258,6 @@ public static function getGroupsWithPermissions(array $general_permissions = [],
 		return $member_groups;
 	}
 
-	/**
-	 * Generate a random validation code.
-	 *
-	 * @return string A random validation code
-	 */
-	public static function generateValidationCode(): string
-	{
-		return bin2hex(random_bytes(5));
-	}
-
 	/**
 	 * Log the spider presence online.
 	 */