Add hashAlgo option to GravatarHelper for legacy MD5 hashing#336
Merged
Conversation
Gravatar switched the avatar email hash from MD5 to SHA-256 in 2024. The helper follows SHA-256 by default, but that changes the generated default avatar (identicon, monsterid, etc.) for every account that has no real Gravatar image, since the picture is derived from the hash. Add a hashAlgo option (sha256 default, md5 supported) so callers can keep the legacy identifier for pre-2024 accounts. Unknown values fall back to sha256, and the option is stripped before building the URL query and the img attributes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Background
Gravatar switched the avatar email hash from MD5 to SHA-256 in 2024.
GravatarHelperfollows SHA-256, which is correct for accounts with a real Gravatar image (legacy MD5 mappings still resolve). But for accounts without a Gravatar image, the generated default avatar (identicon, monsterid, retro, ...) is derived from the hash itself - so switching the algorithm silently changes everyone's default avatar.Change
Add a
hashAlgooption so callers can opt back into the legacy identifier:hashAlgoconfig key, defaultsha256(no behavior change by default)md5supported for pre-2024 accounts that want their familiar default avatar backsha256instead of producing a broken hashTests
Added
testHashAlgoMd5,testHashAlgoFallsBackToSha256, andtestHashAlgoNotLeakedIntoOutput. Full GravatarHelper suite green; phpstan and phpcs clean.