Bug 300336: Bugzilla::Auth should not contain any exported subroutines

Patch By Max Kanat-Alexander <mkanat@bugzilla.org> r=LpSolit, a=justdave

4 files changed, 53 insertions, 55 deletions

diff --git a/Bugzilla/Auth.pm b/Bugzilla/Auth.pm
index 91a0abf83..887caf049 100644
--- a/Bugzilla/Auth.pm
+++ b/Bugzilla/Auth.pm
@@ -23,8 +23,6 @@
 package Bugzilla::Auth;
 
 use strict;
-use base qw(Exporter);
-@Bugzilla::Auth::EXPORT = qw(bz_crypt);
 
 use Bugzilla::Config;
 use Bugzilla::Constants;
@@ -44,31 +42,6 @@ BEGIN {
     }
 }
 
-sub bz_crypt ($) {
-    my ($password) = @_;
-
-    # The list of characters that can appear in a salt.  Salts and hashes
-    # are both encoded as a sequence of characters from a set containing
-    # 64 characters, each one of which represents 6 bits of the salt/hash.
-    # The encoding is similar to BASE64, the difference being that the
-    # BASE64 plus sign (+) is replaced with a forward slash (/).
-    my @saltchars = (0..9, 'A'..'Z', 'a'..'z', '.', '/');
-
-    # Generate the salt.  We use an 8 character (48 bit) salt for maximum
-    # security on systems whose crypt uses MD5.  Systems with older
-    # versions of crypt will just use the first two characters of the salt.
-    my $salt = '';
-    for ( my $i=0 ; $i < 8 ; ++$i ) {
-        $salt .= $saltchars[rand(64)];
-    }
-
-    # Crypt the password.
-    my $cryptedpassword = crypt($password, $salt);
-
-    # Return the crypted password.
-    return $cryptedpassword;
-}
-
 # PRIVATE
 
 # A number of features, like password change requests, require the DB
@@ -160,11 +133,6 @@ __END__
 
 Bugzilla::Auth - Authentication handling for Bugzilla users
 
-=head1 SYNOPSIS
-
-  # Class Functions
-  $crypted = bz_crypt($password);
-
 =head1 DESCRIPTION
 
 Handles authentication for Bugzilla users.
@@ -184,23 +152,6 @@ authentication or login modules.
 
 =over 4
 
-=item C<bz_crypt($password)>
-
-Takes a string and returns a C<crypt>ed value for it, using a random salt.
-
-Please always use this function instead of the built-in perl "crypt"
-when initially encrypting a password.
-
-=begin undocumented
-
-Random salts are generated because the alternative is usually
-to use the first two characters of the password itself, and since
-the salt appears in plaintext at the beginning of the encrypted
-password string this has the effect of revealing the first two
-characters of the password to anyone who views the encrypted version.
-
-=end undocumented
-
 =item C<Bugzilla::Auth::get_netaddr($ipaddr)>
 
 Given an ip address, this returns the associated network address, using
diff --git a/Bugzilla/Auth/Verify/DB.pm b/Bugzilla/Auth/Verify/DB.pm
index 4a45e81e7..405a737b8 100644
--- a/Bugzilla/Auth/Verify/DB.pm
+++ b/Bugzilla/Auth/Verify/DB.pm
@@ -34,10 +34,7 @@ use strict;
 use Bugzilla::Config;
 use Bugzilla::Constants;
 use Bugzilla::Util;
-# Because of the screwy way that Auth works, it thinks
-# that we're redefining subroutines if we "use" anything
-# that "uses" Bugzilla::Auth.
-require Bugzilla::User;
+use Bugzilla::User;
 
 my $edit_options = {
     'new' => 1,
diff --git a/Bugzilla/User.pm b/Bugzilla/User.pm
index e88135b07..847319c18 100644
--- a/Bugzilla/User.pm
+++ b/Bugzilla/User.pm
@@ -41,7 +41,6 @@ use Bugzilla::Error;
 use Bugzilla::Util;
 use Bugzilla::Constants;
 use Bugzilla::User::Setting;
-use Bugzilla::Auth;
 
 use base qw(Exporter);
 @Bugzilla::User::EXPORT = qw(insert_new_user is_available_username
diff --git a/Bugzilla/Util.pm b/Bugzilla/Util.pm
index 91e66f9f8..83c9bf7d3 100644
--- a/Bugzilla/Util.pm
+++ b/Bugzilla/Util.pm
@@ -37,7 +37,8 @@ use base qw(Exporter);
                              diff_arrays diff_strings
                              trim wrap_comment find_wrap_point
                              format_time format_time_decimal
-                             file_mod_time);
+                             file_mod_time
+                             bz_crypt);
 
 use Bugzilla::Config;
 use Bugzilla::Error;
@@ -309,6 +310,31 @@ sub file_mod_time ($) {
     return $mtime;
 }
 
+sub bz_crypt ($) {
+    my ($password) = @_;
+
+    # The list of characters that can appear in a salt.  Salts and hashes
+    # are both encoded as a sequence of characters from a set containing
+    # 64 characters, each one of which represents 6 bits of the salt/hash.
+    # The encoding is similar to BASE64, the difference being that the
+    # BASE64 plus sign (+) is replaced with a forward slash (/).
+    my @saltchars = (0..9, 'A'..'Z', 'a'..'z', '.', '/');
+
+    # Generate the salt.  We use an 8 character (48 bit) salt for maximum
+    # security on systems whose crypt uses MD5.  Systems with older
+    # versions of crypt will just use the first two characters of the salt.
+    my $salt = '';
+    for ( my $i=0 ; $i < 8 ; ++$i ) {
+        $salt .= $saltchars[rand(64)];
+    }
+
+    # Crypt the password.
+    my $cryptedpassword = crypt($password, $salt);
+
+    # Return the crypted password.
+    return $cryptedpassword;
+}
+
 sub ValidateDate {
     my ($date, $format) = @_;
     my $date2;
@@ -369,6 +395,9 @@ Bugzilla::Util - Generic utility functions for bugzilla
   # Functions for dealing with files
   $time = file_mod_time($filename);
 
+  # Cryptographic Functions
+  $crypted_password = bz_crypt($password);
+
 =head1 DESCRIPTION
 
 This package contains various utility functions which do not belong anywhere
@@ -563,3 +592,25 @@ of the "mtime" parameter of the perl "stat" function.
 
 =back
 
+=head2 Cryptography
+
+=over 4
+
+=item C<bz_crypt($password)>
+
+Takes a string and returns a C<crypt>ed value for it, using a random salt.
+
+Please always use this function instead of the built-in perl "crypt"
+when initially encrypting a password.
+
+=begin undocumented
+
+Random salts are generated because the alternative is usually
+to use the first two characters of the password itself, and since
+the salt appears in plaintext at the beginning of the encrypted
+password string this has the effect of revealing the first two
+characters of the password to anyone who views the encrypted version.
+
+=end undocumented
+
+=back