<?php
 class vB_Utility_Password_Validator_Haveibeenpwned { use vB_Utility_Trait_NoSerialize; private int $minCount = 1; private vB_Utility_String $stringUtil; public function __construct(vB_Utility_String $stringUtil) { $this->stringUtil = $stringUtil; } public function validatePassword(string $password) : bool { $hash = sha1($this->stringUtil->toUtf8($password)); $prefix = substr($hash, 0, 5); $remnant = substr($hash, 5); $length = strlen($remnant); $url = new vB_Utility_Url($this->stringUtil, []); $response = $url->get('https://api.pwnedpasswords.com/range/' . $prefix); if (!$response) { return true; } $delimeter = "\r\n"; $tok = strtok($response['body'], $delimeter); while ($tok !== false) { if (substr_compare($tok, $remnant, 0, $length, true) == 0) { [, $count] = explode(':', $tok, 2); if ($count >= $this->minCount) { return false; } } $tok = strtok($delimeter); } return true; } } 