[5.8.17]: sha256 hash filter appends email

[kaspar-allenbach]

The Code: {{ 'email@domain.com' | hash('sha256') }}

returns:

0071b1f724985f4623f5b673c6cdeeb384b684d7ba22ed432c5108b365dafd78email@domain.com

Is this expected behavior? Why would the E-Mail be appended like this to the end of the hash?

I fixed the problem by doing this: {{ order.email | hash('sha256') | truncate(64, '') }}

But that's a bit shaky. (I. don't use it for any security related task)

Craft CMS version

5.8.17

PHP version

8.4

[linear]

CMS-1614 [5.x]: sha256 hash filter appends email

[michaelij]

This hash filter is using \yii\base\Security::hashData which is intended to prevent tampering of that data by hashing it alongside a secret, not actually convert the input to a hash.

I don't think Craft/Twig has a sha256 filter built in, but it'd be easy enough to set up a custom Twig filter using PHP's native hash function.

[brandonkelly]

I just made it possible to pass a hashing algorithm to the hash filter, for Craft 5.9 (4368991). So going forward you will be able to do:

{{ order.email|hash('sha256') }}