diff --git a/resources/sql/patches/20130530.sessionhash.php b/resources/sql/patches/20130530.sessionhash.php
index 4efbe5feec..771dac61e3 100644
--- a/resources/sql/patches/20130530.sessionhash.php
+++ b/resources/sql/patches/20130530.sessionhash.php
@@ -1,22 +1,22 @@
 <?php
 
 $table = new PhabricatorUser();
 $table->openTransaction();
 $conn = $table->establishConnection('w');
 
 $sessions = queryfx_all(
   $conn,
   'SELECT userPHID, type, sessionKey FROM %T FOR UPDATE',
   PhabricatorUser::SESSION_TABLE);
 
 foreach ($sessions as $session) {
   queryfx(
     $conn,
     'UPDATE %T SET sessionKey = %s WHERE userPHID = %s AND type = %s',
     PhabricatorUser::SESSION_TABLE,
-    PhabricatorHash::digest($session['sessionKey']),
+    PhabricatorHash::weakDigest($session['sessionKey']),
     $session['userPHID'],
     $session['type']);
 }
 
 $table->saveTransaction();
diff --git a/src/applications/auth/controller/PhabricatorAuthController.php b/src/applications/auth/controller/PhabricatorAuthController.php
index 4a572edf22..c5b3c1ce99 100644
--- a/src/applications/auth/controller/PhabricatorAuthController.php
+++ b/src/applications/auth/controller/PhabricatorAuthController.php
@@ -1,295 +1,295 @@
 <?php
 
 abstract class PhabricatorAuthController extends PhabricatorController {
 
   protected function renderErrorPage($title, array $messages) {
     $view = new PHUIInfoView();
     $view->setTitle($title);
     $view->setErrors($messages);
 
     return $this->newPage()
       ->setTitle($title)
       ->appendChild($view);
 
   }
 
   /**
    * Returns true if this install is newly setup (i.e., there are no user
    * accounts yet). In this case, we enter a special mode to permit creation
    * of the first account form the web UI.
    */
   protected function isFirstTimeSetup() {
     // If there are any auth providers, this isn't first time setup, even if
     // we don't have accounts.
     if (PhabricatorAuthProvider::getAllEnabledProviders()) {
       return false;
     }
 
     // Otherwise, check if there are any user accounts. If not, we're in first
     // time setup.
     $any_users = id(new PhabricatorPeopleQuery())
       ->setViewer(PhabricatorUser::getOmnipotentUser())
       ->setLimit(1)
       ->execute();
 
     return !$any_users;
   }
 
 
   /**
    * Log a user into a web session and return an @{class:AphrontResponse} which
    * corresponds to continuing the login process.
    *
    * Normally, this is a redirect to the validation controller which makes sure
    * the user's cookies are set. However, event listeners can intercept this
    * event and do something else if they prefer.
    *
    * @param   PhabricatorUser   User to log the viewer in as.
    * @return  AphrontResponse   Response which continues the login process.
    */
   protected function loginUser(PhabricatorUser $user) {
 
     $response = $this->buildLoginValidateResponse($user);
     $session_type = PhabricatorAuthSession::TYPE_WEB;
 
     $event_type = PhabricatorEventType::TYPE_AUTH_WILLLOGINUSER;
     $event_data = array(
       'user'        => $user,
       'type'        => $session_type,
       'response'    => $response,
       'shouldLogin' => true,
     );
 
     $event = id(new PhabricatorEvent($event_type, $event_data))
       ->setUser($user);
     PhutilEventEngine::dispatchEvent($event);
 
     $should_login = $event->getValue('shouldLogin');
     if ($should_login) {
       $session_key = id(new PhabricatorAuthSessionEngine())
         ->establishSession($session_type, $user->getPHID(), $partial = true);
 
       // NOTE: We allow disabled users to login and roadblock them later, so
       // there's no check for users being disabled here.
 
       $request = $this->getRequest();
       $request->setCookie(
         PhabricatorCookies::COOKIE_USERNAME,
         $user->getUsername());
       $request->setCookie(
         PhabricatorCookies::COOKIE_SESSION,
         $session_key);
 
       $this->clearRegistrationCookies();
     }
 
     return $event->getValue('response');
   }
 
   protected function clearRegistrationCookies() {
     $request = $this->getRequest();
 
     // Clear the registration key.
     $request->clearCookie(PhabricatorCookies::COOKIE_REGISTRATION);
 
     // Clear the client ID / OAuth state key.
     $request->clearCookie(PhabricatorCookies::COOKIE_CLIENTID);
 
     // Clear the invite cookie.
     $request->clearCookie(PhabricatorCookies::COOKIE_INVITE);
   }
 
   private function buildLoginValidateResponse(PhabricatorUser $user) {
     $validate_uri = new PhutilURI($this->getApplicationURI('validate/'));
     $validate_uri->setQueryParam('expect', $user->getUsername());
 
     return id(new AphrontRedirectResponse())->setURI((string)$validate_uri);
   }
 
   protected function renderError($message) {
     return $this->renderErrorPage(
       pht('Authentication Error'),
       array(
         $message,
       ));
   }
 
   protected function loadAccountForRegistrationOrLinking($account_key) {
     $request = $this->getRequest();
     $viewer = $request->getUser();
 
     $account = null;
     $provider = null;
     $response = null;
 
     if (!$account_key) {
       $response = $this->renderError(
         pht('Request did not include account key.'));
       return array($account, $provider, $response);
     }
 
     // NOTE: We're using the omnipotent user because the actual user may not
     // be logged in yet, and because we want to tailor an error message to
     // distinguish between "not usable" and "does not exist". We do explicit
     // checks later on to make sure this account is valid for the intended
     // operation. This requires edit permission for completeness and consistency
     // but it won't actually be meaningfully checked because we're using the
     // ominpotent user.
 
     $account = id(new PhabricatorExternalAccountQuery())
       ->setViewer(PhabricatorUser::getOmnipotentUser())
       ->withAccountSecrets(array($account_key))
       ->needImages(true)
       ->requireCapabilities(
         array(
           PhabricatorPolicyCapability::CAN_VIEW,
           PhabricatorPolicyCapability::CAN_EDIT,
         ))
       ->executeOne();
 
     if (!$account) {
       $response = $this->renderError(pht('No valid linkable account.'));
       return array($account, $provider, $response);
     }
 
     if ($account->getUserPHID()) {
       if ($account->getUserPHID() != $viewer->getPHID()) {
         $response = $this->renderError(
           pht(
             'The account you are attempting to register or link is already '.
             'linked to another user.'));
       } else {
         $response = $this->renderError(
           pht(
             'The account you are attempting to link is already linked '.
             'to your account.'));
       }
       return array($account, $provider, $response);
     }
 
     $registration_key = $request->getCookie(
       PhabricatorCookies::COOKIE_REGISTRATION);
 
     // NOTE: This registration key check is not strictly necessary, because
     // we're only creating new accounts, not linking existing accounts. It
     // might be more hassle than it is worth, especially for email.
     //
     // The attack this prevents is getting to the registration screen, then
     // copy/pasting the URL and getting someone else to click it and complete
     // the process. They end up with an account bound to credentials you
     // control. This doesn't really let you do anything meaningful, though,
     // since you could have simply completed the process yourself.
 
     if (!$registration_key) {
       $response = $this->renderError(
         pht(
           'Your browser did not submit a registration key with the request. '.
           'You must use the same browser to begin and complete registration. '.
           'Check that cookies are enabled and try again.'));
       return array($account, $provider, $response);
     }
 
     // We store the digest of the key rather than the key itself to prevent a
     // theoretical attacker with read-only access to the database from
     // hijacking registration sessions.
 
     $actual = $account->getProperty('registrationKey');
-    $expect = PhabricatorHash::digest($registration_key);
+    $expect = PhabricatorHash::weakDigest($registration_key);
     if (!phutil_hashes_are_identical($actual, $expect)) {
       $response = $this->renderError(
         pht(
           'Your browser submitted a different registration key than the one '.
           'associated with this account. You may need to clear your cookies.'));
       return array($account, $provider, $response);
     }
 
     $other_account = id(new PhabricatorExternalAccount())->loadAllWhere(
       'accountType = %s AND accountDomain = %s AND accountID = %s
         AND id != %d',
       $account->getAccountType(),
       $account->getAccountDomain(),
       $account->getAccountID(),
       $account->getID());
 
     if ($other_account) {
       $response = $this->renderError(
         pht(
           'The account you are attempting to register with already belongs '.
           'to another user.'));
       return array($account, $provider, $response);
     }
 
     $provider = PhabricatorAuthProvider::getEnabledProviderByKey(
       $account->getProviderKey());
 
     if (!$provider) {
       $response = $this->renderError(
         pht(
           'The account you are attempting to register with uses a nonexistent '.
           'or disabled authentication provider (with key "%s"). An '.
           'administrator may have recently disabled this provider.',
           $account->getProviderKey()));
       return array($account, $provider, $response);
     }
 
     return array($account, $provider, null);
   }
 
   protected function loadInvite() {
     $invite_cookie = PhabricatorCookies::COOKIE_INVITE;
     $invite_code = $this->getRequest()->getCookie($invite_cookie);
     if (!$invite_code) {
       return null;
     }
 
     $engine = id(new PhabricatorAuthInviteEngine())
       ->setViewer($this->getViewer())
       ->setUserHasConfirmedVerify(true);
 
     try {
       return $engine->processInviteCode($invite_code);
     } catch (Exception $ex) {
       // If this fails for any reason, just drop the invite. In normal
       // circumstances, we gave them a detailed explanation of any error
       // before they jumped into this workflow.
       return null;
     }
   }
 
   protected function renderInviteHeader(PhabricatorAuthInvite $invite) {
     $viewer = $this->getViewer();
 
     // Since the user hasn't registered yet, they may not be able to see other
     // user accounts. Load the inviting user with the omnipotent viewer.
     $omnipotent_viewer = PhabricatorUser::getOmnipotentUser();
 
     $invite_author = id(new PhabricatorPeopleQuery())
       ->setViewer($omnipotent_viewer)
       ->withPHIDs(array($invite->getAuthorPHID()))
       ->needProfileImage(true)
       ->executeOne();
 
     // If we can't load the author for some reason, just drop this message.
     // We lose the value of contextualizing things without author details.
     if (!$invite_author) {
       return null;
     }
 
     $invite_item = id(new PHUIObjectItemView())
       ->setHeader(pht('Welcome to Phabricator!'))
       ->setImageURI($invite_author->getProfileImageURI())
       ->addAttribute(
         pht(
           '%s has invited you to join Phabricator.',
           $invite_author->getFullName()));
 
     $invite_list = id(new PHUIObjectItemListView())
       ->addItem($invite_item)
       ->setFlush(true);
 
     return id(new PHUIBoxView())
       ->addMargin(PHUI::MARGIN_LARGE)
       ->appendChild($invite_list);
   }
 
 }
diff --git a/src/applications/auth/controller/PhabricatorAuthLoginController.php b/src/applications/auth/controller/PhabricatorAuthLoginController.php
index b9b2a8d876..3264e61216 100644
--- a/src/applications/auth/controller/PhabricatorAuthLoginController.php
+++ b/src/applications/auth/controller/PhabricatorAuthLoginController.php
@@ -1,267 +1,267 @@
 <?php
 
 final class PhabricatorAuthLoginController
   extends PhabricatorAuthController {
 
   private $providerKey;
   private $extraURIData;
   private $provider;
 
   public function shouldRequireLogin() {
     return false;
   }
 
   public function shouldAllowRestrictedParameter($parameter_name) {
     // Whitelist the OAuth 'code' parameter.
 
     if ($parameter_name == 'code') {
       return true;
     }
     return parent::shouldAllowRestrictedParameter($parameter_name);
   }
 
   public function getExtraURIData() {
     return $this->extraURIData;
   }
 
   public function handleRequest(AphrontRequest $request) {
     $viewer = $this->getViewer();
     $this->providerKey = $request->getURIData('pkey');
     $this->extraURIData = $request->getURIData('extra');
 
     $response = $this->loadProvider();
     if ($response) {
       return $response;
     }
 
     $provider = $this->provider;
 
     try {
       list($account, $response) = $provider->processLoginRequest($this);
     } catch (PhutilAuthUserAbortedException $ex) {
       if ($viewer->isLoggedIn()) {
         // If a logged-in user cancels, take them back to the external accounts
         // panel.
         $next_uri = '/settings/panel/external/';
       } else {
         // If a logged-out user cancels, take them back to the auth start page.
         $next_uri = '/';
       }
 
       // User explicitly hit "Cancel".
       $dialog = id(new AphrontDialogView())
         ->setUser($viewer)
         ->setTitle(pht('Authentication Canceled'))
         ->appendChild(
           pht('You canceled authentication.'))
         ->addCancelButton($next_uri, pht('Continue'));
       return id(new AphrontDialogResponse())->setDialog($dialog);
     }
 
     if ($response) {
       return $response;
     }
 
     if (!$account) {
       throw new Exception(
         pht(
           'Auth provider failed to load an account from %s!',
           'processLoginRequest()'));
     }
 
     if ($account->getUserPHID()) {
       // The account is already attached to a Phabricator user, so this is
       // either a login or a bad account link request.
       if (!$viewer->isLoggedIn()) {
         if ($provider->shouldAllowLogin()) {
           return $this->processLoginUser($account);
         } else {
           return $this->renderError(
             pht(
               'The external account ("%s") you just authenticated with is '.
               'not configured to allow logins on this Phabricator install. '.
               'An administrator may have recently disabled it.',
               $provider->getProviderName()));
         }
       } else if ($viewer->getPHID() == $account->getUserPHID()) {
         // This is either an attempt to re-link an existing and already
         // linked account (which is silly) or a refresh of an external account
         // (e.g., an OAuth account).
         return id(new AphrontRedirectResponse())
           ->setURI('/settings/panel/external/');
       } else {
         return $this->renderError(
           pht(
             'The external account ("%s") you just used to login is already '.
             'associated with another Phabricator user account. Login to the '.
             'other Phabricator account and unlink the external account before '.
             'linking it to a new Phabricator account.',
             $provider->getProviderName()));
       }
     } else {
       // The account is not yet attached to a Phabricator user, so this is
       // either a registration or an account link request.
       if (!$viewer->isLoggedIn()) {
         if ($provider->shouldAllowRegistration()) {
           return $this->processRegisterUser($account);
         } else {
           return $this->renderError(
             pht(
               'The external account ("%s") you just authenticated with is '.
               'not configured to allow registration on this Phabricator '.
               'install. An administrator may have recently disabled it.',
               $provider->getProviderName()));
         }
       } else {
 
         // If the user already has a linked account of this type, prevent them
         // from linking a second account. This can happen if they swap logins
         // and then refresh the account link. See T6707. We will eventually
         // allow this after T2549.
         $existing_accounts = id(new PhabricatorExternalAccountQuery())
           ->setViewer($viewer)
           ->withUserPHIDs(array($viewer->getPHID()))
           ->withAccountTypes(array($account->getAccountType()))
           ->execute();
         if ($existing_accounts) {
           return $this->renderError(
             pht(
               'Your Phabricator account is already connected to an external '.
               'account on this provider ("%s"), but you are currently logged '.
               'in to the provider with a different account. Log out of the '.
               'external service, then log back in with the correct account '.
               'before refreshing the account link.',
               $provider->getProviderName()));
         }
 
         if ($provider->shouldAllowAccountLink()) {
           return $this->processLinkUser($account);
         } else {
           return $this->renderError(
             pht(
               'The external account ("%s") you just authenticated with is '.
               'not configured to allow account linking on this Phabricator '.
               'install. An administrator may have recently disabled it.',
               $provider->getProviderName()));
         }
       }
     }
 
     // This should be unreachable, but fail explicitly if we get here somehow.
     return new Aphront400Response();
   }
 
   private function processLoginUser(PhabricatorExternalAccount $account) {
     $user = id(new PhabricatorUser())->loadOneWhere(
       'phid = %s',
       $account->getUserPHID());
 
     if (!$user) {
       return $this->renderError(
         pht(
           'The external account you just logged in with is not associated '.
           'with a valid Phabricator user.'));
     }
 
     return $this->loginUser($user);
   }
 
   private function processRegisterUser(PhabricatorExternalAccount $account) {
     $account_secret = $account->getAccountSecret();
     $register_uri = $this->getApplicationURI('register/'.$account_secret.'/');
     return $this->setAccountKeyAndContinue($account, $register_uri);
   }
 
   private function processLinkUser(PhabricatorExternalAccount $account) {
     $account_secret = $account->getAccountSecret();
     $confirm_uri = $this->getApplicationURI('confirmlink/'.$account_secret.'/');
     return $this->setAccountKeyAndContinue($account, $confirm_uri);
   }
 
   private function setAccountKeyAndContinue(
     PhabricatorExternalAccount $account,
     $next_uri) {
 
     if ($account->getUserPHID()) {
       throw new Exception(pht('Account is already registered or linked.'));
     }
 
     // Regenerate the registration secret key, set it on the external account,
     // set a cookie on the user's machine, and redirect them to registration.
     // See PhabricatorAuthRegisterController for discussion of the registration
     // key.
 
     $registration_key = Filesystem::readRandomCharacters(32);
     $account->setProperty(
       'registrationKey',
-      PhabricatorHash::digest($registration_key));
+      PhabricatorHash::weakDigest($registration_key));
 
     $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
       $account->save();
     unset($unguarded);
 
     $this->getRequest()->setTemporaryCookie(
       PhabricatorCookies::COOKIE_REGISTRATION,
       $registration_key);
 
     return id(new AphrontRedirectResponse())->setURI($next_uri);
   }
 
   private function loadProvider() {
     $provider = PhabricatorAuthProvider::getEnabledProviderByKey(
       $this->providerKey);
 
     if (!$provider) {
       return $this->renderError(
         pht(
           'The account you are attempting to login with uses a nonexistent '.
           'or disabled authentication provider (with key "%s"). An '.
           'administrator may have recently disabled this provider.',
           $this->providerKey));
     }
 
     $this->provider = $provider;
 
     return null;
   }
 
   protected function renderError($message) {
     return $this->renderErrorPage(
       pht('Login Failed'),
       array($message));
   }
 
   public function buildProviderPageResponse(
     PhabricatorAuthProvider $provider,
     $content) {
 
     $crumbs = $this->buildApplicationCrumbs();
 
     if ($this->getRequest()->getUser()->isLoggedIn()) {
       $crumbs->addTextCrumb(pht('Link Account'), $provider->getSettingsURI());
     } else {
       $crumbs->addTextCrumb(pht('Login'), $this->getApplicationURI('start/'));
     }
 
     $crumbs->addTextCrumb($provider->getProviderName());
     $crumbs->setBorder(true);
 
     return $this->newPage()
       ->setTitle(pht('Login'))
       ->setCrumbs($crumbs)
       ->appendChild($content);
   }
 
   public function buildProviderErrorResponse(
     PhabricatorAuthProvider $provider,
     $message) {
 
     $message = pht(
       'Authentication provider ("%s") encountered an error during login. %s',
       $provider->getProviderName(),
       $message);
 
     return $this->renderError($message);
   }
 
 }
diff --git a/src/applications/auth/controller/PhabricatorAuthOneTimeLoginController.php b/src/applications/auth/controller/PhabricatorAuthOneTimeLoginController.php
index 627d1b43eb..ebfd07e7ac 100644
--- a/src/applications/auth/controller/PhabricatorAuthOneTimeLoginController.php
+++ b/src/applications/auth/controller/PhabricatorAuthOneTimeLoginController.php
@@ -1,205 +1,205 @@
 <?php
 
 final class PhabricatorAuthOneTimeLoginController
   extends PhabricatorAuthController {
 
   public function shouldRequireLogin() {
     return false;
   }
 
   public function handleRequest(AphrontRequest $request) {
     $viewer = $this->getViewer();
     $id = $request->getURIData('id');
     $link_type = $request->getURIData('type');
     $key = $request->getURIData('key');
     $email_id = $request->getURIData('emailID');
 
     if ($request->getUser()->isLoggedIn()) {
       return $this->renderError(
         pht('You are already logged in.'));
     }
 
     $target_user = id(new PhabricatorPeopleQuery())
       ->setViewer(PhabricatorUser::getOmnipotentUser())
       ->withIDs(array($id))
       ->executeOne();
     if (!$target_user) {
       return new Aphront404Response();
     }
 
     // NOTE: As a convenience to users, these one-time login URIs may also
     // be associated with an email address which will be verified when the
     // URI is used.
 
     // This improves the new user experience for users receiving "Welcome"
     // emails on installs that require verification: if we did not verify the
     // email, they'd immediately get roadblocked with a "Verify Your Email"
     // error and have to go back to their email account, wait for a
     // "Verification" email, and then click that link to actually get access to
     // their account. This is hugely unwieldy, and if the link was only sent
     // to the user's email in the first place we can safely verify it as a
     // side effect of login.
 
     // The email hashed into the URI so users can't verify some email they
     // do not own by doing this:
     //
     //  - Add some address you do not own;
     //  - request a password reset;
     //  - change the URI in the email to the address you don't own;
     //  - login via the email link; and
     //  - get a "verified" address you don't control.
 
     $target_email = null;
     if ($email_id) {
       $target_email = id(new PhabricatorUserEmail())->loadOneWhere(
         'userPHID = %s AND id = %d',
         $target_user->getPHID(),
         $email_id);
       if (!$target_email) {
         return new Aphront404Response();
       }
     }
 
     $engine = new PhabricatorAuthSessionEngine();
     $token = $engine->loadOneTimeLoginKey(
       $target_user,
       $target_email,
       $key);
 
     if (!$token) {
       return $this->newDialog()
         ->setTitle(pht('Unable to Login'))
         ->setShortTitle(pht('Login Failure'))
         ->appendParagraph(
           pht(
             'The login link you clicked is invalid, out of date, or has '.
             'already been used.'))
         ->appendParagraph(
           pht(
             'Make sure you are copy-and-pasting the entire link into '.
             'your browser. Login links are only valid for 24 hours, and '.
             'can only be used once.'))
         ->appendParagraph(
           pht('You can try again, or request a new link via email.'))
         ->addCancelButton('/login/email/', pht('Send Another Email'));
     }
 
     if (!$target_user->canEstablishWebSessions()) {
       return $this->newDialog()
         ->setTitle(pht('Unable to Establish Web Session'))
         ->setShortTitle(pht('Login Failure'))
         ->appendParagraph(
           pht(
             'You are trying to gain access to an account ("%s") that can not '.
             'establish a web session.',
             $target_user->getUsername()))
         ->appendParagraph(
           pht(
             'Special users like daemons and mailing lists are not permitted '.
             'to log in via the web. Log in as a normal user instead.'))
         ->addCancelButton('/');
     }
 
     if ($request->isFormPost()) {
       // If we have an email bound into this URI, verify email so that clicking
       // the link in the "Welcome" email is good enough, without requiring users
       // to go through a second round of email verification.
 
       $editor = id(new PhabricatorUserEditor())
         ->setActor($target_user);
 
       $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
         // Nuke the token and all other outstanding password reset tokens.
         // There is no particular security benefit to destroying them all, but
         // it should reduce HackerOne reports of nebulous harm.
         $editor->revokePasswordResetLinks($target_user);
 
         if ($target_email) {
           $editor->verifyEmail($target_user, $target_email);
         }
       unset($unguarded);
 
       $next = '/';
       if (!PhabricatorPasswordAuthProvider::getPasswordProvider()) {
         $next = '/settings/panel/external/';
       } else {
 
         // We're going to let the user reset their password without knowing
         // the old one. Generate a one-time token for that.
         $key = Filesystem::readRandomCharacters(16);
         $password_type =
           PhabricatorAuthPasswordResetTemporaryTokenType::TOKENTYPE;
 
         $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
           id(new PhabricatorAuthTemporaryToken())
             ->setTokenResource($target_user->getPHID())
             ->setTokenType($password_type)
             ->setTokenExpires(time() + phutil_units('1 hour in seconds'))
-            ->setTokenCode(PhabricatorHash::digest($key))
+            ->setTokenCode(PhabricatorHash::weakDigest($key))
             ->save();
         unset($unguarded);
 
         $username = $target_user->getUsername();
         $panel_uri = "/settings/user/{$username}/page/password/";
 
         $next = (string)id(new PhutilURI($panel_uri))
           ->setQueryParams(
             array(
               'key' => $key,
             ));
 
         $request->setTemporaryCookie(PhabricatorCookies::COOKIE_HISEC, 'yes');
       }
 
       PhabricatorCookies::setNextURICookie($request, $next, $force = true);
 
       return $this->loginUser($target_user);
     }
 
     // NOTE: We need to CSRF here so attackers can't generate an email link,
     // then log a user in to an account they control via sneaky invisible
     // form submissions.
 
     switch ($link_type) {
       case PhabricatorAuthSessionEngine::ONETIME_WELCOME:
         $title = pht('Welcome to Phabricator');
         break;
       case PhabricatorAuthSessionEngine::ONETIME_RECOVER:
         $title = pht('Account Recovery');
         break;
       case PhabricatorAuthSessionEngine::ONETIME_USERNAME:
       case PhabricatorAuthSessionEngine::ONETIME_RESET:
       default:
         $title = pht('Login to Phabricator');
         break;
     }
 
     $body = array();
     $body[] = pht(
       'Use the button below to log in as: %s',
       phutil_tag('strong', array(), $target_user->getUsername()));
 
     if ($target_email && !$target_email->getIsVerified()) {
       $body[] = pht(
         'Logging in will verify %s as an email address you own.',
         phutil_tag('strong', array(), $target_email->getAddress()));
 
     }
 
     $body[] = pht(
       'After logging in you should set a password for your account, or '.
       'link your account to an external account that you can use to '.
       'authenticate in the future.');
 
     $dialog = $this->newDialog()
       ->setTitle($title)
       ->addSubmitButton(pht('Login (%s)', $target_user->getUsername()))
       ->addCancelButton('/');
 
     foreach ($body as $paragraph) {
       $dialog->appendParagraph($paragraph);
     }
 
     return id(new AphrontDialogResponse())->setDialog($dialog);
   }
 }
diff --git a/src/applications/auth/controller/PhabricatorAuthTerminateSessionController.php b/src/applications/auth/controller/PhabricatorAuthTerminateSessionController.php
index 43ac80bb70..fa58977c90 100644
--- a/src/applications/auth/controller/PhabricatorAuthTerminateSessionController.php
+++ b/src/applications/auth/controller/PhabricatorAuthTerminateSessionController.php
@@ -1,77 +1,77 @@
 <?php
 
 final class PhabricatorAuthTerminateSessionController
   extends PhabricatorAuthController {
 
   public function handleRequest(AphrontRequest $request) {
     $viewer = $this->getViewer();
     $id = $request->getURIData('id');
 
     $is_all = ($id === 'all');
 
     $query = id(new PhabricatorAuthSessionQuery())
       ->setViewer($viewer)
       ->withIdentityPHIDs(array($viewer->getPHID()));
     if (!$is_all) {
       $query->withIDs(array($id));
     }
 
-    $current_key = PhabricatorHash::digest(
+    $current_key = PhabricatorHash::weakDigest(
       $request->getCookie(PhabricatorCookies::COOKIE_SESSION));
 
     $sessions = $query->execute();
     foreach ($sessions as $key => $session) {
       $is_current = phutil_hashes_are_identical(
         $session->getSessionKey(),
         $current_key);
       if ($is_current) {
         // Don't terminate the current login session.
         unset($sessions[$key]);
       }
     }
 
     $panel_uri = '/settings/panel/sessions/';
 
     if (!$sessions) {
       return $this->newDialog()
         ->setTitle(pht('No Matching Sessions'))
         ->appendParagraph(
           pht('There are no matching sessions to terminate.'))
         ->appendParagraph(
           pht(
             '(You can not terminate your current login session. To '.
             'terminate it, log out.)'))
         ->addCancelButton($panel_uri);
     }
 
     if ($request->isDialogFormPost()) {
       foreach ($sessions as $session) {
         $session->delete();
       }
       return id(new AphrontRedirectResponse())->setURI($panel_uri);
     }
 
     if ($is_all) {
       $title = pht('Terminate Sessions?');
       $short = pht('Terminate Sessions');
       $body = pht(
         'Really terminate all sessions? (Your current login session will '.
         'not be terminated.)');
     } else {
       $title = pht('Terminate Session?');
       $short = pht('Terminate Session');
       $body = pht(
         'Really terminate session %s?',
         phutil_tag('strong', array(), substr($session->getSessionKey(), 0, 6)));
     }
 
     return $this->newDialog()
       ->setTitle($title)
       ->setShortTitle($short)
       ->appendParagraph($body)
       ->addSubmitButton(pht('Terminate'))
       ->addCancelButton($panel_uri);
   }
 
 
 }
diff --git a/src/applications/auth/engine/PhabricatorAuthSessionEngine.php b/src/applications/auth/engine/PhabricatorAuthSessionEngine.php
index 4e66d3c9f4..82303fff2b 100644
--- a/src/applications/auth/engine/PhabricatorAuthSessionEngine.php
+++ b/src/applications/auth/engine/PhabricatorAuthSessionEngine.php
@@ -1,857 +1,857 @@
 <?php
 
 /**
  *
  * @task use      Using Sessions
  * @task new      Creating Sessions
  * @task hisec    High Security
  * @task partial  Partial Sessions
  * @task onetime  One Time Login URIs
  * @task cache    User Cache
  */
 final class PhabricatorAuthSessionEngine extends Phobject {
 
   /**
    * Session issued to normal users after they login through a standard channel.
    * Associates the client with a standard user identity.
    */
   const KIND_USER      = 'U';
 
 
   /**
    * Session issued to users who login with some sort of credentials but do not
    * have full accounts. These are sometimes called "grey users".
    *
    * TODO: We do not currently issue these sessions, see T4310.
    */
   const KIND_EXTERNAL  = 'X';
 
 
   /**
    * Session issued to logged-out users which has no real identity information.
    * Its purpose is to protect logged-out users from CSRF.
    */
   const KIND_ANONYMOUS = 'A';
 
 
   /**
    * Session kind isn't known.
    */
   const KIND_UNKNOWN   = '?';
 
 
   const ONETIME_RECOVER = 'recover';
   const ONETIME_RESET = 'reset';
   const ONETIME_WELCOME = 'welcome';
   const ONETIME_USERNAME = 'rename';
 
 
   /**
    * Get the session kind (e.g., anonymous, user, external account) from a
    * session token. Returns a `KIND_` constant.
    *
    * @param   string  Session token.
    * @return  const   Session kind constant.
    */
   public static function getSessionKindFromToken($session_token) {
     if (strpos($session_token, '/') === false) {
       // Old-style session, these are all user sessions.
       return self::KIND_USER;
     }
 
     list($kind, $key) = explode('/', $session_token, 2);
 
     switch ($kind) {
       case self::KIND_ANONYMOUS:
       case self::KIND_USER:
       case self::KIND_EXTERNAL:
         return $kind;
       default:
         return self::KIND_UNKNOWN;
     }
   }
 
 
   /**
    * Load the user identity associated with a session of a given type,
    * identified by token.
    *
    * When the user presents a session token to an API, this method verifies
    * it is of the correct type and loads the corresponding identity if the
    * session exists and is valid.
    *
    * NOTE: `$session_type` is the type of session that is required by the
    * loading context. This prevents use of a Conduit sesssion as a Web
    * session, for example.
    *
    * @param const The type of session to load.
    * @param string The session token.
    * @return PhabricatorUser|null
    * @task use
    */
   public function loadUserForSession($session_type, $session_token) {
     $session_kind = self::getSessionKindFromToken($session_token);
     switch ($session_kind) {
       case self::KIND_ANONYMOUS:
         // Don't bother trying to load a user for an anonymous session, since
         // neither the session nor the user exist.
         return null;
       case self::KIND_UNKNOWN:
         // If we don't know what kind of session this is, don't go looking for
         // it.
         return null;
       case self::KIND_USER:
         break;
       case self::KIND_EXTERNAL:
         // TODO: Implement these (T4310).
         return null;
     }
 
     $session_table = new PhabricatorAuthSession();
     $user_table = new PhabricatorUser();
     $conn_r = $session_table->establishConnection('r');
-    $session_key = PhabricatorHash::digest($session_token);
+    $session_key = PhabricatorHash::weakDigest($session_token);
 
     $cache_parts = $this->getUserCacheQueryParts($conn_r);
     list($cache_selects, $cache_joins, $cache_map, $types_map) = $cache_parts;
 
     $info = queryfx_one(
       $conn_r,
       'SELECT
           s.id AS s_id,
           s.sessionExpires AS s_sessionExpires,
           s.sessionStart AS s_sessionStart,
           s.highSecurityUntil AS s_highSecurityUntil,
           s.isPartial AS s_isPartial,
           s.signedLegalpadDocuments as s_signedLegalpadDocuments,
           u.*
           %Q
         FROM %T u JOIN %T s ON u.phid = s.userPHID
         AND s.type = %s AND s.sessionKey = %s %Q',
       $cache_selects,
       $user_table->getTableName(),
       $session_table->getTableName(),
       $session_type,
       $session_key,
       $cache_joins);
 
     if (!$info) {
       return null;
     }
 
     $session_dict = array(
       'userPHID' => $info['phid'],
       'sessionKey' => $session_key,
       'type' => $session_type,
     );
 
     $cache_raw = array_fill_keys($cache_map, null);
     foreach ($info as $key => $value) {
       if (strncmp($key, 's_', 2) === 0) {
         unset($info[$key]);
         $session_dict[substr($key, 2)] = $value;
         continue;
       }
 
       if (isset($cache_map[$key])) {
         unset($info[$key]);
         $cache_raw[$cache_map[$key]] = $value;
         continue;
       }
     }
 
     $user = $user_table->loadFromArray($info);
 
     $cache_raw = $this->filterRawCacheData($user, $types_map, $cache_raw);
     $user->attachRawCacheData($cache_raw);
 
     switch ($session_type) {
       case PhabricatorAuthSession::TYPE_WEB:
         // Explicitly prevent bots and mailing lists from establishing web
         // sessions. It's normally impossible to attach authentication to these
         // accounts, and likewise impossible to generate sessions, but it's
         // technically possible that a session could exist in the database. If
         // one does somehow, refuse to load it.
         if (!$user->canEstablishWebSessions()) {
           return null;
         }
         break;
     }
 
     $session = id(new PhabricatorAuthSession())->loadFromArray($session_dict);
 
     $ttl = PhabricatorAuthSession::getSessionTypeTTL($session_type);
 
     // If more than 20% of the time on this session has been used, refresh the
     // TTL back up to the full duration. The idea here is that sessions are
     // good forever if used regularly, but get GC'd when they fall out of use.
 
     // NOTE: If we begin rotating session keys when extending sessions, the
     // CSRF code needs to be updated so CSRF tokens survive session rotation.
 
     if (time() + (0.80 * $ttl) > $session->getSessionExpires()) {
       $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
         $conn_w = $session_table->establishConnection('w');
         queryfx(
           $conn_w,
           'UPDATE %T SET sessionExpires = UNIX_TIMESTAMP() + %d WHERE id = %d',
           $session->getTableName(),
           $ttl,
           $session->getID());
       unset($unguarded);
     }
 
     $user->attachSession($session);
     return $user;
   }
 
 
   /**
    * Issue a new session key for a given identity. Phabricator supports
    * different types of sessions (like "web" and "conduit") and each session
    * type may have multiple concurrent sessions (this allows a user to be
    * logged in on multiple browsers at the same time, for instance).
    *
    * Note that this method is transport-agnostic and does not set cookies or
    * issue other types of tokens, it ONLY generates a new session key.
    *
    * You can configure the maximum number of concurrent sessions for various
    * session types in the Phabricator configuration.
    *
    * @param   const     Session type constant (see
    *                    @{class:PhabricatorAuthSession}).
    * @param   phid|null Identity to establish a session for, usually a user
    *                    PHID. With `null`, generates an anonymous session.
    * @param   bool      True to issue a partial session.
    * @return  string    Newly generated session key.
    */
   public function establishSession($session_type, $identity_phid, $partial) {
     // Consume entropy to generate a new session key, forestalling the eventual
     // heat death of the universe.
     $session_key = Filesystem::readRandomCharacters(40);
 
     if ($identity_phid === null) {
       return self::KIND_ANONYMOUS.'/'.$session_key;
     }
 
     $session_table = new PhabricatorAuthSession();
     $conn_w = $session_table->establishConnection('w');
 
     // This has a side effect of validating the session type.
     $session_ttl = PhabricatorAuthSession::getSessionTypeTTL($session_type);
 
-    $digest_key = PhabricatorHash::digest($session_key);
+    $digest_key = PhabricatorHash::weakDigest($session_key);
 
     // Logging-in users don't have CSRF stuff yet, so we have to unguard this
     // write.
     $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
       id(new PhabricatorAuthSession())
         ->setUserPHID($identity_phid)
         ->setType($session_type)
         ->setSessionKey($digest_key)
         ->setSessionStart(time())
         ->setSessionExpires(time() + $session_ttl)
         ->setIsPartial($partial ? 1 : 0)
         ->setSignedLegalpadDocuments(0)
         ->save();
 
       $log = PhabricatorUserLog::initializeNewLog(
         null,
         $identity_phid,
         ($partial
           ? PhabricatorUserLog::ACTION_LOGIN_PARTIAL
           : PhabricatorUserLog::ACTION_LOGIN));
 
       $log->setDetails(
         array(
           'session_type' => $session_type,
         ));
       $log->setSession($digest_key);
       $log->save();
     unset($unguarded);
 
     $info = id(new PhabricatorAuthSessionInfo())
       ->setSessionType($session_type)
       ->setIdentityPHID($identity_phid)
       ->setIsPartial($partial);
 
     $extensions = PhabricatorAuthSessionEngineExtension::getAllExtensions();
     foreach ($extensions as $extension) {
       $extension->didEstablishSession($info);
     }
 
     return $session_key;
   }
 
 
   /**
    * Terminate all of a user's login sessions.
    *
    * This is used when users change passwords, linked accounts, or add
    * multifactor authentication.
    *
    * @param PhabricatorUser User whose sessions should be terminated.
    * @param string|null Optionally, one session to keep. Normally, the current
    *   login session.
    *
    * @return void
    */
   public function terminateLoginSessions(
     PhabricatorUser $user,
     $except_session = null) {
 
     $sessions = id(new PhabricatorAuthSessionQuery())
       ->setViewer($user)
       ->withIdentityPHIDs(array($user->getPHID()))
       ->execute();
 
     if ($except_session !== null) {
-      $except_session = PhabricatorHash::digest($except_session);
+      $except_session = PhabricatorHash::weakDigest($except_session);
     }
 
     foreach ($sessions as $key => $session) {
       if ($except_session !== null) {
         $is_except = phutil_hashes_are_identical(
           $session->getSessionKey(),
           $except_session);
         if ($is_except) {
           continue;
         }
       }
 
       $session->delete();
     }
   }
 
   public function logoutSession(
     PhabricatorUser $user,
     PhabricatorAuthSession $session) {
 
     $log = PhabricatorUserLog::initializeNewLog(
       $user,
       $user->getPHID(),
       PhabricatorUserLog::ACTION_LOGOUT);
     $log->save();
 
     $extensions = PhabricatorAuthSessionEngineExtension::getAllExtensions();
     foreach ($extensions as $extension) {
       $extension->didLogout($user, array($session));
     }
 
     $session->delete();
   }
 
 
 /* -(  High Security  )------------------------------------------------------ */
 
 
   /**
    * Require high security, or prompt the user to enter high security.
    *
    * If the user's session is in high security, this method will return a
    * token. Otherwise, it will throw an exception which will eventually
    * be converted into a multi-factor authentication workflow.
    *
    * @param PhabricatorUser User whose session needs to be in high security.
    * @param AphrontReqeust  Current request.
    * @param string          URI to return the user to if they cancel.
    * @param bool            True to jump partial sessions directly into high
    *                        security instead of just upgrading them to full
    *                        sessions.
    * @return PhabricatorAuthHighSecurityToken Security token.
    * @task hisec
    */
   public function requireHighSecuritySession(
     PhabricatorUser $viewer,
     AphrontRequest $request,
     $cancel_uri,
     $jump_into_hisec = false) {
 
     if (!$viewer->hasSession()) {
       throw new Exception(
         pht('Requiring a high-security session from a user with no session!'));
     }
 
     $session = $viewer->getSession();
 
     // Check if the session is already in high security mode.
     $token = $this->issueHighSecurityToken($session);
     if ($token) {
       return $token;
     }
 
     // Load the multi-factor auth sources attached to this account.
     $factors = id(new PhabricatorAuthFactorConfig())->loadAllWhere(
       'userPHID = %s',
       $viewer->getPHID());
 
     // If the account has no associated multi-factor auth, just issue a token
     // without putting the session into high security mode. This is generally
     // easier for users. A minor but desirable side effect is that when a user
     // adds an auth factor, existing sessions won't get a free pass into hisec,
     // since they never actually got marked as hisec.
     if (!$factors) {
       return $this->issueHighSecurityToken($session, true);
     }
 
     // Check for a rate limit without awarding points, so the user doesn't
     // get partway through the workflow only to get blocked.
     PhabricatorSystemActionEngine::willTakeAction(
       array($viewer->getPHID()),
       new PhabricatorAuthTryFactorAction(),
       0);
 
     $validation_results = array();
     if ($request->isHTTPPost()) {
       $request->validateCSRF();
       if ($request->getExists(AphrontRequest::TYPE_HISEC)) {
 
         // Limit factor verification rates to prevent brute force attacks.
         PhabricatorSystemActionEngine::willTakeAction(
           array($viewer->getPHID()),
           new PhabricatorAuthTryFactorAction(),
           1);
 
         $ok = true;
         foreach ($factors as $factor) {
           $id = $factor->getID();
           $impl = $factor->requireImplementation();
 
           $validation_results[$id] = $impl->processValidateFactorForm(
             $factor,
             $viewer,
             $request);
 
           if (!$impl->isFactorValid($factor, $validation_results[$id])) {
             $ok = false;
           }
         }
 
         if ($ok) {
           // Give the user a credit back for a successful factor verification.
           PhabricatorSystemActionEngine::willTakeAction(
             array($viewer->getPHID()),
             new PhabricatorAuthTryFactorAction(),
             -1);
 
           if ($session->getIsPartial() && !$jump_into_hisec) {
             // If we have a partial session and are not jumping directly into
             // hisec, just issue a token without putting it in high security
             // mode.
             return $this->issueHighSecurityToken($session, true);
           }
 
           $until = time() + phutil_units('15 minutes in seconds');
           $session->setHighSecurityUntil($until);
 
           queryfx(
             $session->establishConnection('w'),
             'UPDATE %T SET highSecurityUntil = %d WHERE id = %d',
             $session->getTableName(),
             $until,
             $session->getID());
 
           $log = PhabricatorUserLog::initializeNewLog(
             $viewer,
             $viewer->getPHID(),
             PhabricatorUserLog::ACTION_ENTER_HISEC);
           $log->save();
         } else {
           $log = PhabricatorUserLog::initializeNewLog(
             $viewer,
             $viewer->getPHID(),
             PhabricatorUserLog::ACTION_FAIL_HISEC);
           $log->save();
         }
       }
     }
 
     $token = $this->issueHighSecurityToken($session);
     if ($token) {
       return $token;
     }
 
     throw id(new PhabricatorAuthHighSecurityRequiredException())
       ->setCancelURI($cancel_uri)
       ->setFactors($factors)
       ->setFactorValidationResults($validation_results);
   }
 
 
   /**
    * Issue a high security token for a session, if authorized.
    *
    * @param PhabricatorAuthSession Session to issue a token for.
    * @param bool Force token issue.
    * @return PhabricatorAuthHighSecurityToken|null Token, if authorized.
    * @task hisec
    */
   private function issueHighSecurityToken(
     PhabricatorAuthSession $session,
     $force = false) {
 
     $until = $session->getHighSecurityUntil();
     if ($until > time() || $force) {
       return new PhabricatorAuthHighSecurityToken();
     }
 
     return null;
   }
 
 
   /**
    * Render a form for providing relevant multi-factor credentials.
    *
    * @param PhabricatorUser Viewing user.
    * @param AphrontRequest Current request.
    * @return AphrontFormView Renderable form.
    * @task hisec
    */
   public function renderHighSecurityForm(
     array $factors,
     array $validation_results,
     PhabricatorUser $viewer,
     AphrontRequest $request) {
 
     $form = id(new AphrontFormView())
       ->setUser($viewer)
       ->appendRemarkupInstructions('');
 
     foreach ($factors as $factor) {
       $factor->requireImplementation()->renderValidateFactorForm(
         $factor,
         $form,
         $viewer,
         idx($validation_results, $factor->getID()));
     }
 
     $form->appendRemarkupInstructions('');
 
     return $form;
   }
 
 
   /**
    * Strip the high security flag from a session.
    *
    * Kicks a session out of high security and logs the exit.
    *
    * @param PhabricatorUser Acting user.
    * @param PhabricatorAuthSession Session to return to normal security.
    * @return void
    * @task hisec
    */
   public function exitHighSecurity(
     PhabricatorUser $viewer,
     PhabricatorAuthSession $session) {
 
     if (!$session->getHighSecurityUntil()) {
       return;
     }
 
     queryfx(
       $session->establishConnection('w'),
       'UPDATE %T SET highSecurityUntil = NULL WHERE id = %d',
       $session->getTableName(),
       $session->getID());
 
     $log = PhabricatorUserLog::initializeNewLog(
       $viewer,
       $viewer->getPHID(),
       PhabricatorUserLog::ACTION_EXIT_HISEC);
     $log->save();
   }
 
 
 /* -(  Partial Sessions  )--------------------------------------------------- */
 
 
   /**
    * Upgrade a partial session to a full session.
    *
    * @param PhabricatorAuthSession Session to upgrade.
    * @return void
    * @task partial
    */
   public function upgradePartialSession(PhabricatorUser $viewer) {
 
     if (!$viewer->hasSession()) {
       throw new Exception(
         pht('Upgrading partial session of user with no session!'));
     }
 
     $session = $viewer->getSession();
 
     if (!$session->getIsPartial()) {
       throw new Exception(pht('Session is not partial!'));
     }
 
     $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
       $session->setIsPartial(0);
 
       queryfx(
         $session->establishConnection('w'),
         'UPDATE %T SET isPartial = %d WHERE id = %d',
         $session->getTableName(),
         0,
         $session->getID());
 
       $log = PhabricatorUserLog::initializeNewLog(
         $viewer,
         $viewer->getPHID(),
         PhabricatorUserLog::ACTION_LOGIN_FULL);
       $log->save();
     unset($unguarded);
   }
 
 
 /* -(  Legalpad Documents )-------------------------------------------------- */
 
 
   /**
    * Upgrade a session to have all legalpad documents signed.
    *
    * @param PhabricatorUser User whose session should upgrade.
    * @param array LegalpadDocument objects
    * @return void
    * @task partial
    */
   public function signLegalpadDocuments(PhabricatorUser $viewer, array $docs) {
 
     if (!$viewer->hasSession()) {
       throw new Exception(
         pht('Signing session legalpad documents of user with no session!'));
     }
 
     $session = $viewer->getSession();
 
     if ($session->getSignedLegalpadDocuments()) {
       throw new Exception(pht(
         'Session has already signed required legalpad documents!'));
     }
 
     $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
       $session->setSignedLegalpadDocuments(1);
 
       queryfx(
         $session->establishConnection('w'),
         'UPDATE %T SET signedLegalpadDocuments = %d WHERE id = %d',
         $session->getTableName(),
         1,
         $session->getID());
 
       if (!empty($docs)) {
         $log = PhabricatorUserLog::initializeNewLog(
           $viewer,
           $viewer->getPHID(),
           PhabricatorUserLog::ACTION_LOGIN_LEGALPAD);
         $log->save();
       }
     unset($unguarded);
   }
 
 
 /* -(  One Time Login URIs  )------------------------------------------------ */
 
 
   /**
    * Retrieve a temporary, one-time URI which can log in to an account.
    *
    * These URIs are used for password recovery and to regain access to accounts
    * which users have been locked out of.
    *
    * @param PhabricatorUser User to generate a URI for.
    * @param PhabricatorUserEmail Optionally, email to verify when
    *  link is used.
    * @param string Optional context string for the URI. This is purely cosmetic
    *  and used only to customize workflow and error messages.
    * @return string Login URI.
    * @task onetime
    */
   public function getOneTimeLoginURI(
     PhabricatorUser $user,
     PhabricatorUserEmail $email = null,
     $type = self::ONETIME_RESET) {
 
     $key = Filesystem::readRandomCharacters(32);
     $key_hash = $this->getOneTimeLoginKeyHash($user, $email, $key);
     $onetime_type = PhabricatorAuthOneTimeLoginTemporaryTokenType::TOKENTYPE;
 
     $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
       id(new PhabricatorAuthTemporaryToken())
         ->setTokenResource($user->getPHID())
         ->setTokenType($onetime_type)
         ->setTokenExpires(time() + phutil_units('1 day in seconds'))
         ->setTokenCode($key_hash)
         ->save();
     unset($unguarded);
 
     $uri = '/login/once/'.$type.'/'.$user->getID().'/'.$key.'/';
     if ($email) {
       $uri = $uri.$email->getID().'/';
     }
 
     try {
       $uri = PhabricatorEnv::getProductionURI($uri);
     } catch (Exception $ex) {
       // If a user runs `bin/auth recover` before configuring the base URI,
       // just show the path. We don't have any way to figure out the domain.
       // See T4132.
     }
 
     return $uri;
   }
 
 
   /**
    * Load the temporary token associated with a given one-time login key.
    *
    * @param PhabricatorUser User to load the token for.
    * @param PhabricatorUserEmail Optionally, email to verify when
    *  link is used.
    * @param string Key user is presenting as a valid one-time login key.
    * @return PhabricatorAuthTemporaryToken|null Token, if one exists.
    * @task onetime
    */
   public function loadOneTimeLoginKey(
     PhabricatorUser $user,
     PhabricatorUserEmail $email = null,
     $key = null) {
 
     $key_hash = $this->getOneTimeLoginKeyHash($user, $email, $key);
     $onetime_type = PhabricatorAuthOneTimeLoginTemporaryTokenType::TOKENTYPE;
 
     return id(new PhabricatorAuthTemporaryTokenQuery())
       ->setViewer($user)
       ->withTokenResources(array($user->getPHID()))
       ->withTokenTypes(array($onetime_type))
       ->withTokenCodes(array($key_hash))
       ->withExpired(false)
       ->executeOne();
   }
 
 
   /**
    * Hash a one-time login key for storage as a temporary token.
    *
    * @param PhabricatorUser User this key is for.
    * @param PhabricatorUserEmail Optionally, email to verify when
    *  link is used.
    * @param string The one time login key.
    * @return string Hash of the key.
    * task onetime
    */
   private function getOneTimeLoginKeyHash(
     PhabricatorUser $user,
     PhabricatorUserEmail $email = null,
     $key = null) {
 
     $parts = array(
       $key,
       $user->getAccountSecret(),
     );
 
     if ($email) {
       $parts[] = $email->getVerificationCode();
     }
 
-    return PhabricatorHash::digest(implode(':', $parts));
+    return PhabricatorHash::weakDigest(implode(':', $parts));
   }
 
 
 /* -(  User Cache  )--------------------------------------------------------- */
 
 
   /**
    * @task cache
    */
   private function getUserCacheQueryParts(AphrontDatabaseConnection $conn) {
     $cache_selects = array();
     $cache_joins = array();
     $cache_map = array();
 
     $keys = array();
     $types_map = array();
 
     $cache_types = PhabricatorUserCacheType::getAllCacheTypes();
     foreach ($cache_types as $cache_type) {
       foreach ($cache_type->getAutoloadKeys() as $autoload_key) {
         $keys[] = $autoload_key;
         $types_map[$autoload_key] = $cache_type;
       }
     }
 
     $cache_table = id(new PhabricatorUserCache())->getTableName();
 
     $cache_idx = 1;
     foreach ($keys as $key) {
       $join_as = 'ucache_'.$cache_idx;
       $select_as = 'ucache_'.$cache_idx.'_v';
 
       $cache_selects[] = qsprintf(
         $conn,
         '%T.cacheData %T',
         $join_as,
         $select_as);
 
       $cache_joins[] = qsprintf(
         $conn,
         'LEFT JOIN %T AS %T ON u.phid = %T.userPHID
           AND %T.cacheIndex = %s',
         $cache_table,
         $join_as,
         $join_as,
         $join_as,
         PhabricatorHash::digestForIndex($key));
 
       $cache_map[$select_as] = $key;
 
       $cache_idx++;
     }
 
     if ($cache_selects) {
       $cache_selects = ', '.implode(', ', $cache_selects);
     } else {
       $cache_selects = '';
     }
 
     if ($cache_joins) {
       $cache_joins = implode(' ', $cache_joins);
     } else {
       $cache_joins = '';
     }
 
     return array($cache_selects, $cache_joins, $cache_map, $types_map);
   }
 
   private function filterRawCacheData(
     PhabricatorUser $user,
     array $types_map,
     array $cache_raw) {
 
     foreach ($cache_raw as $cache_key => $cache_data) {
       $type = $types_map[$cache_key];
       if ($type->shouldValidateRawCacheData()) {
         if (!$type->isRawCacheDataValid($user, $cache_key, $cache_data)) {
           unset($cache_raw[$cache_key]);
         }
       }
     }
 
     return $cache_raw;
   }
 
   public function willServeRequestForUser(PhabricatorUser $user) {
     // We allow the login user to generate any missing cache data inline.
     $user->setAllowInlineCacheGeneration(true);
 
     // Switch to the user's translation.
     PhabricatorEnv::setLocaleCode($user->getTranslation());
 
     $extensions = PhabricatorAuthSessionEngineExtension::getAllExtensions();
     foreach ($extensions as $extension) {
       $extension->willServeRequestForUser($user);
     }
   }
 
 }
diff --git a/src/applications/auth/factor/PhabricatorTOTPAuthFactor.php b/src/applications/auth/factor/PhabricatorTOTPAuthFactor.php
index 8875b960e2..10c44aaec0 100644
--- a/src/applications/auth/factor/PhabricatorTOTPAuthFactor.php
+++ b/src/applications/auth/factor/PhabricatorTOTPAuthFactor.php
@@ -1,305 +1,305 @@
 <?php
 
 final class PhabricatorTOTPAuthFactor extends PhabricatorAuthFactor {
 
   public function getFactorKey() {
     return 'totp';
   }
 
   public function getFactorName() {
     return pht('Mobile Phone App (TOTP)');
   }
 
   public function getFactorDescription() {
     return pht(
       'Attach a mobile authenticator application (like Authy '.
       'or Google Authenticator) to your account. When you need to '.
       'authenticate, you will enter a code shown on your phone.');
   }
 
   public function processAddFactorForm(
     AphrontFormView $form,
     AphrontRequest $request,
     PhabricatorUser $user) {
 
     $totp_token_type = PhabricatorAuthTOTPKeyTemporaryTokenType::TOKENTYPE;
 
     $key = $request->getStr('totpkey');
     if (strlen($key)) {
       // If the user is providing a key, make sure it's a key we generated.
       // This raises the barrier to theoretical attacks where an attacker might
       // provide a known key (such attacks are already prevented by CSRF, but
       // this is a second barrier to overcome).
 
       // (We store and verify the hash of the key, not the key itself, to limit
       // how useful the data in the table is to an attacker.)
 
       $temporary_token = id(new PhabricatorAuthTemporaryTokenQuery())
         ->setViewer($user)
         ->withTokenResources(array($user->getPHID()))
         ->withTokenTypes(array($totp_token_type))
         ->withExpired(false)
-        ->withTokenCodes(array(PhabricatorHash::digest($key)))
+        ->withTokenCodes(array(PhabricatorHash::weakDigest($key)))
         ->executeOne();
       if (!$temporary_token) {
         // If we don't have a matching token, regenerate the key below.
         $key = null;
       }
     }
 
     if (!strlen($key)) {
       $key = self::generateNewTOTPKey();
 
       // Mark this key as one we generated, so the user is allowed to submit
       // a response for it.
 
       $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
         id(new PhabricatorAuthTemporaryToken())
           ->setTokenResource($user->getPHID())
           ->setTokenType($totp_token_type)
           ->setTokenExpires(time() + phutil_units('1 hour in seconds'))
-          ->setTokenCode(PhabricatorHash::digest($key))
+          ->setTokenCode(PhabricatorHash::weakDigest($key))
           ->save();
       unset($unguarded);
     }
 
     $code = $request->getStr('totpcode');
 
     $e_code = true;
     if ($request->getExists('totp')) {
       $okay = self::verifyTOTPCode(
         $user,
         new PhutilOpaqueEnvelope($key),
         $code);
 
       if ($okay) {
         $config = $this->newConfigForUser($user)
           ->setFactorName(pht('Mobile App (TOTP)'))
           ->setFactorSecret($key);
 
         return $config;
       } else {
         if (!strlen($code)) {
           $e_code = pht('Required');
         } else {
           $e_code = pht('Invalid');
         }
       }
     }
 
     $form->addHiddenInput('totp', true);
     $form->addHiddenInput('totpkey', $key);
 
     $form->appendRemarkupInstructions(
       pht(
         'First, download an authenticator application on your phone. Two '.
         'applications which work well are **Authy** and **Google '.
         'Authenticator**, but any other TOTP application should also work.'));
 
     $form->appendInstructions(
       pht(
         'Launch the application on your phone, and add a new entry for '.
         'this Phabricator install. When prompted, scan the QR code or '.
         'manually enter the key shown below into the application.'));
 
     $prod_uri = new PhutilURI(PhabricatorEnv::getProductionURI('/'));
     $issuer = $prod_uri->getDomain();
 
     $uri = urisprintf(
       'otpauth://totp/%s:%s?secret=%s&issuer=%s',
       $issuer,
       $user->getUsername(),
       $key,
       $issuer);
 
     $qrcode = $this->renderQRCode($uri);
     $form->appendChild($qrcode);
 
     $form->appendChild(
       id(new AphrontFormStaticControl())
         ->setLabel(pht('Key'))
         ->setValue(phutil_tag('strong', array(), $key)));
 
     $form->appendInstructions(
       pht(
         '(If given an option, select that this key is "Time Based", not '.
         '"Counter Based".)'));
 
     $form->appendInstructions(
       pht(
         'After entering the key, the application should display a numeric '.
         'code. Enter that code below to confirm that you have configured '.
         'the authenticator correctly:'));
 
     $form->appendChild(
       id(new PHUIFormNumberControl())
         ->setLabel(pht('TOTP Code'))
         ->setName('totpcode')
         ->setValue($code)
         ->setError($e_code));
 
   }
 
   public function renderValidateFactorForm(
     PhabricatorAuthFactorConfig $config,
     AphrontFormView $form,
     PhabricatorUser $viewer,
     $validation_result) {
 
     if (!$validation_result) {
       $validation_result = array();
     }
 
     $form->appendChild(
       id(new PHUIFormNumberControl())
         ->setName($this->getParameterName($config, 'totpcode'))
         ->setLabel(pht('App Code'))
         ->setCaption(pht('Factor Name: %s', $config->getFactorName()))
         ->setValue(idx($validation_result, 'value'))
         ->setError(idx($validation_result, 'error', true)));
   }
 
   public function processValidateFactorForm(
     PhabricatorAuthFactorConfig $config,
     PhabricatorUser $viewer,
     AphrontRequest $request) {
 
     $code = $request->getStr($this->getParameterName($config, 'totpcode'));
     $key = new PhutilOpaqueEnvelope($config->getFactorSecret());
 
     if (self::verifyTOTPCode($viewer, $key, $code)) {
       return array(
         'error' => null,
         'value' => $code,
         'valid' => true,
       );
     } else {
       return array(
         'error' => strlen($code) ? pht('Invalid') : pht('Required'),
         'value' => $code,
         'valid' => false,
       );
     }
   }
 
 
   public static function generateNewTOTPKey() {
     return strtoupper(Filesystem::readRandomCharacters(16));
   }
 
   public static function verifyTOTPCode(
     PhabricatorUser $user,
     PhutilOpaqueEnvelope $key,
     $code) {
 
     $now = (int)(time() / 30);
 
     // Allow the user to enter a code a few minutes away on either side, in
     // case the server or client has some clock skew.
     for ($offset = -2; $offset <= 2; $offset++) {
       $real = self::getTOTPCode($key, $now + $offset);
       if (phutil_hashes_are_identical($real, $code)) {
         return true;
       }
     }
 
     // TODO: After validating a code, this should mark it as used and prevent
     // it from being reused.
 
     return false;
   }
 
 
   public static function base32Decode($buf) {
     $buf = strtoupper($buf);
 
     $map = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
     $map = str_split($map);
     $map = array_flip($map);
 
     $out = '';
     $len = strlen($buf);
     $acc = 0;
     $bits = 0;
     for ($ii = 0; $ii < $len; $ii++) {
       $chr = $buf[$ii];
       $val = $map[$chr];
 
       $acc = $acc << 5;
       $acc = $acc + $val;
 
       $bits += 5;
       if ($bits >= 8) {
         $bits = $bits - 8;
         $out .= chr(($acc & (0xFF << $bits)) >> $bits);
       }
     }
 
     return $out;
   }
 
   public static function getTOTPCode(PhutilOpaqueEnvelope $key, $timestamp) {
     $binary_timestamp = pack('N*', 0).pack('N*', $timestamp);
     $binary_key = self::base32Decode($key->openEnvelope());
 
     $hash = hash_hmac('sha1', $binary_timestamp, $binary_key, true);
 
     // See RFC 4226.
 
     $offset = ord($hash[19]) & 0x0F;
 
     $code = ((ord($hash[$offset + 0]) & 0x7F) << 24) |
             ((ord($hash[$offset + 1]) & 0xFF) << 16) |
             ((ord($hash[$offset + 2]) & 0xFF) <<  8) |
             ((ord($hash[$offset + 3])       )      );
 
     $code = ($code % 1000000);
     $code = str_pad($code, 6, '0', STR_PAD_LEFT);
 
     return $code;
   }
 
 
   /**
    * @phutil-external-symbol class QRcode
    */
   private function renderQRCode($uri) {
     $root = dirname(phutil_get_library_root('phabricator'));
     require_once $root.'/externals/phpqrcode/phpqrcode.php';
 
     $lines = QRcode::text($uri);
 
     $total_width = 240;
     $cell_size = floor($total_width / count($lines));
 
     $rows = array();
     foreach ($lines as $line) {
       $cells = array();
       for ($ii = 0; $ii < strlen($line); $ii++) {
         if ($line[$ii] == '1') {
           $color = '#000';
         } else {
           $color = '#fff';
         }
 
         $cells[] = phutil_tag(
           'td',
           array(
             'width' => $cell_size,
             'height' => $cell_size,
             'style' => 'background: '.$color,
           ),
           '');
       }
       $rows[] = phutil_tag('tr', array(), $cells);
     }
 
     return phutil_tag(
       'table',
       array(
         'style' => 'margin: 24px auto;',
       ),
       $rows);
   }
 
 }
diff --git a/src/applications/auth/provider/PhabricatorAuthProvider.php b/src/applications/auth/provider/PhabricatorAuthProvider.php
index a3f77618e4..4dd7f4da1b 100644
--- a/src/applications/auth/provider/PhabricatorAuthProvider.php
+++ b/src/applications/auth/provider/PhabricatorAuthProvider.php
@@ -1,508 +1,508 @@
 <?php
 
 abstract class PhabricatorAuthProvider extends Phobject {
 
   private $providerConfig;
 
   public function attachProviderConfig(PhabricatorAuthProviderConfig $config) {
     $this->providerConfig = $config;
     return $this;
   }
 
   public function hasProviderConfig() {
     return (bool)$this->providerConfig;
   }
 
   public function getProviderConfig() {
     if ($this->providerConfig === null) {
       throw new PhutilInvalidStateException('attachProviderConfig');
     }
     return $this->providerConfig;
   }
 
   public function getConfigurationHelp() {
     return null;
   }
 
   public function getDefaultProviderConfig() {
     return id(new PhabricatorAuthProviderConfig())
       ->setProviderClass(get_class($this))
       ->setIsEnabled(1)
       ->setShouldAllowLogin(1)
       ->setShouldAllowRegistration(1)
       ->setShouldAllowLink(1)
       ->setShouldAllowUnlink(1);
   }
 
   public function getNameForCreate() {
     return $this->getProviderName();
   }
 
   public function getDescriptionForCreate() {
     return null;
   }
 
   public function getProviderKey() {
     return $this->getAdapter()->getAdapterKey();
   }
 
   public function getProviderType() {
     return $this->getAdapter()->getAdapterType();
   }
 
   public function getProviderDomain() {
     return $this->getAdapter()->getAdapterDomain();
   }
 
   public static function getAllBaseProviders() {
     return id(new PhutilClassMapQuery())
       ->setAncestorClass(__CLASS__)
       ->execute();
   }
 
   public static function getAllProviders() {
     static $providers;
 
     if ($providers === null) {
       $objects = self::getAllBaseProviders();
 
       $configs = id(new PhabricatorAuthProviderConfigQuery())
         ->setViewer(PhabricatorUser::getOmnipotentUser())
         ->execute();
 
       $providers = array();
       foreach ($configs as $config) {
         if (!isset($objects[$config->getProviderClass()])) {
           // This configuration is for a provider which is not installed.
           continue;
         }
 
         $object = clone $objects[$config->getProviderClass()];
         $object->attachProviderConfig($config);
 
         $key = $object->getProviderKey();
         if (isset($providers[$key])) {
           throw new Exception(
             pht(
               "Two authentication providers use the same provider key ".
               "('%s'). Each provider must be identified by a unique key.",
               $key));
         }
         $providers[$key] = $object;
       }
     }
 
     return $providers;
   }
 
   public static function getAllEnabledProviders() {
     $providers = self::getAllProviders();
     foreach ($providers as $key => $provider) {
       if (!$provider->isEnabled()) {
         unset($providers[$key]);
       }
     }
     return $providers;
   }
 
   public static function getEnabledProviderByKey($provider_key) {
     return idx(self::getAllEnabledProviders(), $provider_key);
   }
 
   abstract public function getProviderName();
   abstract public function getAdapter();
 
   public function isEnabled() {
     return $this->getProviderConfig()->getIsEnabled();
   }
 
   public function shouldAllowLogin() {
     return $this->getProviderConfig()->getShouldAllowLogin();
   }
 
   public function shouldAllowRegistration() {
     if (!$this->shouldAllowLogin()) {
       return false;
     }
 
     return $this->getProviderConfig()->getShouldAllowRegistration();
   }
 
   public function shouldAllowAccountLink() {
     return $this->getProviderConfig()->getShouldAllowLink();
   }
 
   public function shouldAllowAccountUnlink() {
     return $this->getProviderConfig()->getShouldAllowUnlink();
   }
 
   public function shouldTrustEmails() {
     return $this->shouldAllowEmailTrustConfiguration() &&
            $this->getProviderConfig()->getShouldTrustEmails();
   }
 
   /**
    * Should we allow the adapter to be marked as "trusted". This is true for
    * all adapters except those that allow the user to type in emails (see
    * @{class:PhabricatorPasswordAuthProvider}).
    */
   public function shouldAllowEmailTrustConfiguration() {
     return true;
   }
 
   public function buildLoginForm(PhabricatorAuthStartController $controller) {
     return $this->renderLoginForm($controller->getRequest(), $mode = 'start');
   }
 
   public function buildInviteForm(PhabricatorAuthStartController $controller) {
     return $this->renderLoginForm($controller->getRequest(), $mode = 'invite');
   }
 
   abstract public function processLoginRequest(
     PhabricatorAuthLoginController $controller);
 
   public function buildLinkForm(PhabricatorAuthLinkController $controller) {
     return $this->renderLoginForm($controller->getRequest(), $mode = 'link');
   }
 
   public function shouldAllowAccountRefresh() {
     return true;
   }
 
   public function buildRefreshForm(
     PhabricatorAuthLinkController $controller) {
     return $this->renderLoginForm($controller->getRequest(), $mode = 'refresh');
   }
 
   protected function renderLoginForm(AphrontRequest $request, $mode) {
     throw new PhutilMethodNotImplementedException();
   }
 
   public function createProviders() {
     return array($this);
   }
 
   protected function willSaveAccount(PhabricatorExternalAccount $account) {
     return;
   }
 
   public function willRegisterAccount(PhabricatorExternalAccount $account) {
     return;
   }
 
   protected function loadOrCreateAccount($account_id) {
     if (!strlen($account_id)) {
       throw new Exception(pht('Empty account ID!'));
     }
 
     $adapter = $this->getAdapter();
     $adapter_class = get_class($adapter);
 
     if (!strlen($adapter->getAdapterType())) {
       throw new Exception(
         pht(
           "AuthAdapter (of class '%s') has an invalid implementation: ".
           "no adapter type.",
           $adapter_class));
     }
 
     if (!strlen($adapter->getAdapterDomain())) {
       throw new Exception(
         pht(
           "AuthAdapter (of class '%s') has an invalid implementation: ".
           "no adapter domain.",
           $adapter_class));
     }
 
     $account = id(new PhabricatorExternalAccount())->loadOneWhere(
       'accountType = %s AND accountDomain = %s AND accountID = %s',
       $adapter->getAdapterType(),
       $adapter->getAdapterDomain(),
       $account_id);
     if (!$account) {
       $account = id(new PhabricatorExternalAccount())
         ->setAccountType($adapter->getAdapterType())
         ->setAccountDomain($adapter->getAdapterDomain())
         ->setAccountID($account_id);
     }
 
     $account->setUsername($adapter->getAccountName());
     $account->setRealName($adapter->getAccountRealName());
     $account->setEmail($adapter->getAccountEmail());
     $account->setAccountURI($adapter->getAccountURI());
 
     $account->setProfileImagePHID(null);
     $image_uri = $adapter->getAccountImageURI();
     if ($image_uri) {
       try {
         $name = PhabricatorSlug::normalize($this->getProviderName());
         $name = $name.'-profile.jpg';
 
         // TODO: If the image has not changed, we do not need to make a new
         // file entry for it, but there's no convenient way to do this with
         // PhabricatorFile right now. The storage will get shared, so the impact
         // here is negligible.
         $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
           $image_file = PhabricatorFile::newFromFileDownload(
             $image_uri,
             array(
               'name' => $name,
               'viewPolicy' => PhabricatorPolicies::POLICY_NOONE,
             ));
           if ($image_file->isViewableImage()) {
             $image_file
               ->setViewPolicy(PhabricatorPolicies::getMostOpenPolicy())
               ->setCanCDN(true)
               ->save();
             $account->setProfileImagePHID($image_file->getPHID());
           } else {
             $image_file->delete();
           }
         unset($unguarded);
 
       } catch (Exception $ex) {
         // Log this but proceed, it's not especially important that we
         // be able to pull profile images.
         phlog($ex);
       }
     }
 
     $this->willSaveAccount($account);
 
     $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
     $account->save();
     unset($unguarded);
 
     return $account;
   }
 
   public function getLoginURI() {
     $app = PhabricatorApplication::getByClass('PhabricatorAuthApplication');
     return $app->getApplicationURI('/login/'.$this->getProviderKey().'/');
   }
 
   public function getSettingsURI() {
     return '/settings/panel/external/';
   }
 
   public function getStartURI() {
     $app = PhabricatorApplication::getByClass('PhabricatorAuthApplication');
     $uri = $app->getApplicationURI('/start/');
     return $uri;
   }
 
   public function isDefaultRegistrationProvider() {
     return false;
   }
 
   public function shouldRequireRegistrationPassword() {
     return false;
   }
 
   public function getDefaultExternalAccount() {
     throw new PhutilMethodNotImplementedException();
   }
 
   public function getLoginOrder() {
     return '500-'.$this->getProviderName();
   }
 
   protected function getLoginIcon() {
     return 'Generic';
   }
 
   public function isLoginFormAButton() {
     return false;
   }
 
   public function renderConfigPropertyTransactionTitle(
     PhabricatorAuthProviderConfigTransaction $xaction) {
 
     return null;
   }
 
   public function readFormValuesFromProvider() {
     return array();
   }
 
   public function readFormValuesFromRequest(AphrontRequest $request) {
     return array();
   }
 
   public function processEditForm(
     AphrontRequest $request,
     array $values) {
 
     $errors = array();
     $issues = array();
 
     return array($errors, $issues, $values);
   }
 
   public function extendEditForm(
     AphrontRequest $request,
     AphrontFormView $form,
     array $values,
     array $issues) {
 
     return;
   }
 
   public function willRenderLinkedAccount(
     PhabricatorUser $viewer,
     PHUIObjectItemView $item,
     PhabricatorExternalAccount $account) {
 
     $account_view = id(new PhabricatorAuthAccountView())
       ->setExternalAccount($account)
       ->setAuthProvider($this);
 
     $item->appendChild(
       phutil_tag(
         'div',
         array(
           'class' => 'mmr mml mst mmb',
         ),
         $account_view));
   }
 
   /**
    * Return true to use a two-step configuration (setup, configure) instead of
    * the default single-step configuration. In practice, this means that
    * creating a new provider instance will redirect back to the edit page
    * instead of the provider list.
    *
    * @return bool True if this provider uses two-step configuration.
    */
   public function hasSetupStep() {
     return false;
   }
 
   /**
    * Render a standard login/register button element.
    *
    * The `$attributes` parameter takes these keys:
    *
    *   - `uri`: URI the button should take the user to when clicked.
    *   - `method`: Optional HTTP method the button should use, defaults to GET.
    *
    * @param   AphrontRequest  HTTP request.
    * @param   string          Request mode string.
    * @param   map             Additional parameters, see above.
    * @return  wild            Login button.
    */
   protected function renderStandardLoginButton(
     AphrontRequest $request,
     $mode,
     array $attributes = array()) {
 
     PhutilTypeSpec::checkMap(
       $attributes,
       array(
         'method' => 'optional string',
         'uri' => 'string',
         'sigil' => 'optional string',
       ));
 
     $viewer = $request->getUser();
     $adapter = $this->getAdapter();
 
     if ($mode == 'link') {
       $button_text = pht('Link External Account');
     } else if ($mode == 'refresh') {
       $button_text = pht('Refresh Account Link');
     } else if ($mode == 'invite') {
       $button_text = pht('Register Account');
     } else if ($this->shouldAllowRegistration()) {
       $button_text = pht('Login or Register');
     } else {
       $button_text = pht('Login');
     }
 
     $icon = id(new PHUIIconView())
       ->setSpriteSheet(PHUIIconView::SPRITE_LOGIN)
       ->setSpriteIcon($this->getLoginIcon());
 
     $button = id(new PHUIButtonView())
       ->setSize(PHUIButtonView::BIG)
       ->setColor(PHUIButtonView::GREY)
       ->setIcon($icon)
       ->setText($button_text)
       ->setSubtext($this->getProviderName());
 
     $uri = $attributes['uri'];
     $uri = new PhutilURI($uri);
     $params = $uri->getQueryParams();
     $uri->setQueryParams(array());
 
     $content = array($button);
 
     foreach ($params as $key => $value) {
       $content[] = phutil_tag(
         'input',
         array(
           'type' => 'hidden',
           'name' => $key,
           'value' => $value,
         ));
     }
 
     return phabricator_form(
       $viewer,
       array(
         'method' => idx($attributes, 'method', 'GET'),
         'action' => (string)$uri,
         'sigil'  => idx($attributes, 'sigil'),
       ),
       $content);
   }
 
   public function renderConfigurationFooter() {
     return null;
   }
 
   public function getAuthCSRFCode(AphrontRequest $request) {
     $phcid = $request->getCookie(PhabricatorCookies::COOKIE_CLIENTID);
     if (!strlen($phcid)) {
       throw new AphrontMalformedRequestException(
         pht('Missing Client ID Cookie'),
         pht(
           'Your browser did not submit a "%s" cookie with client state '.
           'information in the request. Check that cookies are enabled. '.
           'If this problem persists, you may need to clear your cookies.',
           PhabricatorCookies::COOKIE_CLIENTID),
         true);
     }
 
-    return PhabricatorHash::digest($phcid);
+    return PhabricatorHash::weakDigest($phcid);
   }
 
   protected function verifyAuthCSRFCode(AphrontRequest $request, $actual) {
     $expect = $this->getAuthCSRFCode($request);
 
     if (!strlen($actual)) {
       throw new Exception(
         pht(
           'The authentication provider did not return a client state '.
           'parameter in its response, but one was expected. If this '.
           'problem persists, you may need to clear your cookies.'));
     }
 
     if (!phutil_hashes_are_identical($actual, $expect)) {
       throw new Exception(
         pht(
           'The authentication provider did not return the correct client '.
           'state parameter in its response. If this problem persists, you may '.
           'need to clear your cookies.'));
     }
   }
 
   public function supportsAutoLogin() {
     return false;
   }
 
   public function getAutoLoginURI(AphrontRequest $request) {
     throw new PhutilMethodNotImplementedException();
   }
 
 }
diff --git a/src/applications/auth/query/PhabricatorAuthSessionQuery.php b/src/applications/auth/query/PhabricatorAuthSessionQuery.php
index 966bb946c4..dea95dd450 100644
--- a/src/applications/auth/query/PhabricatorAuthSessionQuery.php
+++ b/src/applications/auth/query/PhabricatorAuthSessionQuery.php
@@ -1,112 +1,112 @@
 <?php
 
 final class PhabricatorAuthSessionQuery
   extends PhabricatorCursorPagedPolicyAwareQuery {
 
   private $ids;
   private $identityPHIDs;
   private $sessionKeys;
   private $sessionTypes;
 
   public function withIdentityPHIDs(array $identity_phids) {
     $this->identityPHIDs = $identity_phids;
     return $this;
   }
 
   public function withSessionKeys(array $keys) {
     $this->sessionKeys = $keys;
     return $this;
   }
 
   public function withSessionTypes(array $types) {
     $this->sessionTypes = $types;
     return $this;
   }
 
   public function withIDs(array $ids) {
     $this->ids = $ids;
     return $this;
   }
 
   protected function loadPage() {
     $table = new PhabricatorAuthSession();
     $conn_r = $table->establishConnection('r');
 
     $data = queryfx_all(
       $conn_r,
       'SELECT * FROM %T %Q %Q %Q',
       $table->getTableName(),
       $this->buildWhereClause($conn_r),
       $this->buildOrderClause($conn_r),
       $this->buildLimitClause($conn_r));
 
     return $table->loadAllFromArray($data);
   }
 
   protected function willFilterPage(array $sessions) {
     $identity_phids = mpull($sessions, 'getUserPHID');
 
     $identity_objects = id(new PhabricatorObjectQuery())
       ->setViewer($this->getViewer())
       ->setParentQuery($this)
       ->withPHIDs($identity_phids)
       ->execute();
     $identity_objects = mpull($identity_objects, null, 'getPHID');
 
     foreach ($sessions as $key => $session) {
       $identity_object = idx($identity_objects, $session->getUserPHID());
       if (!$identity_object) {
         unset($sessions[$key]);
       } else {
         $session->attachIdentityObject($identity_object);
       }
     }
 
     return $sessions;
   }
 
   protected function buildWhereClause(AphrontDatabaseConnection $conn_r) {
     $where = array();
 
     if ($this->ids) {
       $where[] = qsprintf(
         $conn_r,
         'id IN (%Ld)',
         $this->ids);
     }
 
     if ($this->identityPHIDs) {
       $where[] = qsprintf(
         $conn_r,
         'userPHID IN (%Ls)',
         $this->identityPHIDs);
     }
 
     if ($this->sessionKeys) {
       $hashes = array();
       foreach ($this->sessionKeys as $session_key) {
-        $hashes[] = PhabricatorHash::digest($session_key);
+        $hashes[] = PhabricatorHash::weakDigest($session_key);
       }
       $where[] = qsprintf(
         $conn_r,
         'sessionKey IN (%Ls)',
         $hashes);
     }
 
     if ($this->sessionTypes) {
       $where[] = qsprintf(
         $conn_r,
         'type IN (%Ls)',
         $this->sessionTypes);
     }
 
     $where[] = $this->buildPagingClause($conn_r);
 
     return $this->formatWhereClause($where);
   }
 
   public function getQueryApplicationClass() {
     return 'PhabricatorAuthApplication';
   }
 
 }
diff --git a/src/applications/base/controller/PhabricatorController.php b/src/applications/base/controller/PhabricatorController.php
index f2b267b67f..58d8f6cf6f 100644
--- a/src/applications/base/controller/PhabricatorController.php
+++ b/src/applications/base/controller/PhabricatorController.php
@@ -1,578 +1,578 @@
 <?php
 
 abstract class PhabricatorController extends AphrontController {
 
   private $handles;
 
   public function shouldRequireLogin() {
     return true;
   }
 
   public function shouldRequireAdmin() {
     return false;
   }
 
   public function shouldRequireEnabledUser() {
     return true;
   }
 
   public function shouldAllowPublic() {
     return false;
   }
 
   public function shouldAllowPartialSessions() {
     return false;
   }
 
   public function shouldRequireEmailVerification() {
     return PhabricatorUserEmail::isEmailVerificationRequired();
   }
 
   public function shouldAllowRestrictedParameter($parameter_name) {
     return false;
   }
 
   public function shouldRequireMultiFactorEnrollment() {
     if (!$this->shouldRequireLogin()) {
       return false;
     }
 
     if (!$this->shouldRequireEnabledUser()) {
       return false;
     }
 
     if ($this->shouldAllowPartialSessions()) {
       return false;
     }
 
     $user = $this->getRequest()->getUser();
     if (!$user->getIsStandardUser()) {
       return false;
     }
 
     return PhabricatorEnv::getEnvConfig('security.require-multi-factor-auth');
   }
 
   public function shouldAllowLegallyNonCompliantUsers() {
     return false;
   }
 
   public function isGlobalDragAndDropUploadEnabled() {
     return false;
   }
 
   public function willBeginExecution() {
     $request = $this->getRequest();
 
     if ($request->getUser()) {
       // NOTE: Unit tests can set a user explicitly. Normal requests are not
       // permitted to do this.
       PhabricatorTestCase::assertExecutingUnitTests();
       $user = $request->getUser();
     } else {
       $user = new PhabricatorUser();
       $session_engine = new PhabricatorAuthSessionEngine();
 
       $phsid = $request->getCookie(PhabricatorCookies::COOKIE_SESSION);
       if (strlen($phsid)) {
         $session_user = $session_engine->loadUserForSession(
           PhabricatorAuthSession::TYPE_WEB,
           $phsid);
         if ($session_user) {
           $user = $session_user;
         }
       } else {
         // If the client doesn't have a session token, generate an anonymous
         // session. This is used to provide CSRF protection to logged-out users.
         $phsid = $session_engine->establishSession(
           PhabricatorAuthSession::TYPE_WEB,
           null,
           $partial = false);
 
         // This may be a resource request, in which case we just don't set
         // the cookie.
         if ($request->canSetCookies()) {
           $request->setCookie(PhabricatorCookies::COOKIE_SESSION, $phsid);
         }
       }
 
 
       if (!$user->isLoggedIn()) {
-        $user->attachAlternateCSRFString(PhabricatorHash::digest($phsid));
+        $user->attachAlternateCSRFString(PhabricatorHash::weakDigest($phsid));
       }
 
       $request->setUser($user);
     }
 
     id(new PhabricatorAuthSessionEngine())
       ->willServeRequestForUser($user);
 
     if (PhabricatorEnv::getEnvConfig('darkconsole.enabled')) {
       $dark_console = PhabricatorDarkConsoleSetting::SETTINGKEY;
       if ($user->getUserSetting($dark_console) ||
          PhabricatorEnv::getEnvConfig('darkconsole.always-on')) {
         $console = new DarkConsoleCore();
         $request->getApplicationConfiguration()->setConsole($console);
       }
     }
 
     // NOTE: We want to set up the user first so we can render a real page
     // here, but fire this before any real logic.
     $restricted = array(
       'code',
     );
     foreach ($restricted as $parameter) {
       if ($request->getExists($parameter)) {
         if (!$this->shouldAllowRestrictedParameter($parameter)) {
           throw new Exception(
             pht(
               'Request includes restricted parameter "%s", but this '.
               'controller ("%s") does not whitelist it. Refusing to '.
               'serve this request because it might be part of a redirection '.
               'attack.',
               $parameter,
               get_class($this)));
         }
       }
     }
 
     if ($this->shouldRequireEnabledUser()) {
       if ($user->isLoggedIn() && !$user->getIsApproved()) {
         $controller = new PhabricatorAuthNeedsApprovalController();
         return $this->delegateToController($controller);
       }
       if ($user->getIsDisabled()) {
         $controller = new PhabricatorDisabledUserController();
         return $this->delegateToController($controller);
       }
     }
 
     $auth_class = 'PhabricatorAuthApplication';
     $auth_application = PhabricatorApplication::getByClass($auth_class);
 
     // Require partial sessions to finish login before doing anything.
     if (!$this->shouldAllowPartialSessions()) {
       if ($user->hasSession() &&
           $user->getSession()->getIsPartial()) {
         $login_controller = new PhabricatorAuthFinishController();
         $this->setCurrentApplication($auth_application);
         return $this->delegateToController($login_controller);
       }
     }
 
     // Check if the user needs to configure MFA.
     $need_mfa = $this->shouldRequireMultiFactorEnrollment();
     $have_mfa = $user->getIsEnrolledInMultiFactor();
     if ($need_mfa && !$have_mfa) {
       // Check if the cache is just out of date. Otherwise, roadblock the user
       // and require MFA enrollment.
       $user->updateMultiFactorEnrollment();
       if (!$user->getIsEnrolledInMultiFactor()) {
         $mfa_controller = new PhabricatorAuthNeedsMultiFactorController();
         $this->setCurrentApplication($auth_application);
         return $this->delegateToController($mfa_controller);
       }
     }
 
     if ($this->shouldRequireLogin()) {
       // This actually means we need either:
       //   - a valid user, or a public controller; and
       //   - permission to see the application; and
       //   - permission to see at least one Space if spaces are configured.
 
       $allow_public = $this->shouldAllowPublic() &&
                       PhabricatorEnv::getEnvConfig('policy.allow-public');
 
       // If this controller isn't public, and the user isn't logged in, require
       // login.
       if (!$allow_public && !$user->isLoggedIn()) {
         $login_controller = new PhabricatorAuthStartController();
         $this->setCurrentApplication($auth_application);
         return $this->delegateToController($login_controller);
       }
 
       if ($user->isLoggedIn()) {
         if ($this->shouldRequireEmailVerification()) {
           if (!$user->getIsEmailVerified()) {
             $controller = new PhabricatorMustVerifyEmailController();
             $this->setCurrentApplication($auth_application);
             return $this->delegateToController($controller);
           }
         }
       }
 
       // If Spaces are configured, require that the user have access to at
       // least one. If we don't do this, they'll get confusing error messages
       // later on.
       $spaces = PhabricatorSpacesNamespaceQuery::getSpacesExist();
       if ($spaces) {
         $viewer_spaces = PhabricatorSpacesNamespaceQuery::getViewerSpaces(
           $user);
         if (!$viewer_spaces) {
           $controller = new PhabricatorSpacesNoAccessController();
           return $this->delegateToController($controller);
         }
       }
 
       // If the user doesn't have access to the application, don't let them use
       // any of its controllers. We query the application in order to generate
       // a policy exception if the viewer doesn't have permission.
       $application = $this->getCurrentApplication();
       if ($application) {
         id(new PhabricatorApplicationQuery())
           ->setViewer($user)
           ->withPHIDs(array($application->getPHID()))
           ->executeOne();
       }
     }
 
 
     if (!$this->shouldAllowLegallyNonCompliantUsers()) {
       $legalpad_class = 'PhabricatorLegalpadApplication';
       $legalpad = id(new PhabricatorApplicationQuery())
         ->setViewer($user)
         ->withClasses(array($legalpad_class))
         ->withInstalled(true)
         ->execute();
       $legalpad = head($legalpad);
 
       $doc_query = id(new LegalpadDocumentQuery())
         ->setViewer($user)
         ->withSignatureRequired(1)
         ->needViewerSignatures(true);
 
       if ($user->hasSession() &&
           !$user->getSession()->getIsPartial() &&
           !$user->getSession()->getSignedLegalpadDocuments() &&
           $user->isLoggedIn() &&
           $legalpad) {
 
         $sign_docs = $doc_query->execute();
         $must_sign_docs = array();
         foreach ($sign_docs as $sign_doc) {
           if (!$sign_doc->getUserSignature($user->getPHID())) {
             $must_sign_docs[] = $sign_doc;
           }
         }
         if ($must_sign_docs) {
           $controller = new LegalpadDocumentSignController();
           $this->getRequest()->setURIMap(array(
             'id' => head($must_sign_docs)->getID(),
           ));
           $this->setCurrentApplication($legalpad);
           return $this->delegateToController($controller);
         } else {
           $engine = id(new PhabricatorAuthSessionEngine())
             ->signLegalpadDocuments($user, $sign_docs);
         }
       }
     }
 
     // NOTE: We do this last so that users get a login page instead of a 403
     // if they need to login.
     if ($this->shouldRequireAdmin() && !$user->getIsAdmin()) {
       return new Aphront403Response();
     }
   }
 
   public function getApplicationURI($path = '') {
     if (!$this->getCurrentApplication()) {
       throw new Exception(pht('No application!'));
     }
     return $this->getCurrentApplication()->getApplicationURI($path);
   }
 
   public function willSendResponse(AphrontResponse $response) {
     $request = $this->getRequest();
 
     if ($response instanceof AphrontDialogResponse) {
       if (!$request->isAjax() && !$request->isQuicksand()) {
         $dialog = $response->getDialog();
 
         $title = $dialog->getTitle();
         $short = $dialog->getShortTitle();
 
         $crumbs = $this->buildApplicationCrumbs();
         $crumbs->addTextCrumb(coalesce($short, $title));
 
         $page_content = array(
           $crumbs,
           $response->buildResponseString(),
         );
 
         $view = id(new PhabricatorStandardPageView())
           ->setRequest($request)
           ->setController($this)
           ->setDeviceReady(true)
           ->setTitle($title)
           ->appendChild($page_content);
 
         $response = id(new AphrontWebpageResponse())
           ->setContent($view->render())
           ->setHTTPResponseCode($response->getHTTPResponseCode());
       } else {
         $response->getDialog()->setIsStandalone(true);
 
         return id(new AphrontAjaxResponse())
           ->setContent(array(
             'dialog' => $response->buildResponseString(),
           ));
       }
     } else if ($response instanceof AphrontRedirectResponse) {
       if ($request->isAjax() || $request->isQuicksand()) {
         return id(new AphrontAjaxResponse())
           ->setContent(
             array(
               'redirect' => $response->getURI(),
             ));
       }
     }
 
     return $response;
   }
 
   /**
    * WARNING: Do not call this in new code.
    *
    * @deprecated See "Handles Technical Documentation".
    */
   protected function loadViewerHandles(array $phids) {
     return id(new PhabricatorHandleQuery())
       ->setViewer($this->getRequest()->getUser())
       ->withPHIDs($phids)
       ->execute();
   }
 
   public function buildApplicationMenu() {
     return null;
   }
 
   protected function buildApplicationCrumbs() {
     $crumbs = array();
 
     $application = $this->getCurrentApplication();
     if ($application) {
       $icon = $application->getIcon();
       if (!$icon) {
         $icon = 'fa-puzzle';
       }
 
       $crumbs[] = id(new PHUICrumbView())
         ->setHref($this->getApplicationURI())
         ->setName($application->getName())
         ->setIcon($icon);
     }
 
     $view = new PHUICrumbsView();
     foreach ($crumbs as $crumb) {
       $view->addCrumb($crumb);
     }
 
     return $view;
   }
 
   protected function hasApplicationCapability($capability) {
     return PhabricatorPolicyFilter::hasCapability(
       $this->getRequest()->getUser(),
       $this->getCurrentApplication(),
       $capability);
   }
 
   protected function requireApplicationCapability($capability) {
     PhabricatorPolicyFilter::requireCapability(
       $this->getRequest()->getUser(),
       $this->getCurrentApplication(),
       $capability);
   }
 
   protected function explainApplicationCapability(
     $capability,
     $positive_message,
     $negative_message) {
 
     $can_act = $this->hasApplicationCapability($capability);
     if ($can_act) {
       $message = $positive_message;
       $icon_name = 'fa-play-circle-o lightgreytext';
     } else {
       $message = $negative_message;
       $icon_name = 'fa-lock';
     }
 
     $icon = id(new PHUIIconView())
       ->setIcon($icon_name);
 
     require_celerity_resource('policy-css');
 
     $phid = $this->getCurrentApplication()->getPHID();
     $explain_uri = "/policy/explain/{$phid}/{$capability}/";
 
     $message = phutil_tag(
       'div',
       array(
         'class' => 'policy-capability-explanation',
       ),
       array(
         $icon,
         javelin_tag(
           'a',
           array(
             'href' => $explain_uri,
             'sigil' => 'workflow',
           ),
           $message),
       ));
 
     return array($can_act, $message);
   }
 
   public function getDefaultResourceSource() {
     return 'phabricator';
   }
 
   /**
    * Create a new @{class:AphrontDialogView} with defaults filled in.
    *
    * @return AphrontDialogView New dialog.
    */
   public function newDialog() {
     $submit_uri = new PhutilURI($this->getRequest()->getRequestURI());
     $submit_uri = $submit_uri->getPath();
 
     return id(new AphrontDialogView())
       ->setUser($this->getRequest()->getUser())
       ->setSubmitURI($submit_uri);
   }
 
   public function newPage() {
     $page = id(new PhabricatorStandardPageView())
       ->setRequest($this->getRequest())
       ->setController($this)
       ->setDeviceReady(true);
 
     $application = $this->getCurrentApplication();
     if ($application) {
       $page->setApplicationName($application->getName());
       if ($application->getTitleGlyph()) {
         $page->setGlyph($application->getTitleGlyph());
       }
     }
 
     $viewer = $this->getRequest()->getUser();
     if ($viewer) {
       $page->setUser($viewer);
     }
 
     return $page;
   }
 
   public function newApplicationMenu() {
     return id(new PHUIApplicationMenuView())
       ->setViewer($this->getViewer());
   }
 
   public function newCurtainView($object) {
     $viewer = $this->getViewer();
 
     $action_id = celerity_generate_unique_node_id();
 
     $action_list = id(new PhabricatorActionListView())
       ->setViewer($viewer)
       ->setID($action_id);
 
     // NOTE: Applications (objects of class PhabricatorApplication) can't
     // currently be set here, although they don't need any of the extensions
     // anyway. This should probably work differently than it does, though.
     if ($object instanceof PhabricatorLiskDAO) {
       $action_list->setObject($object);
     }
 
     $curtain = id(new PHUICurtainView())
       ->setViewer($viewer)
       ->setActionList($action_list);
 
     $panels = PHUICurtainExtension::buildExtensionPanels($viewer, $object);
     foreach ($panels as $panel) {
       $curtain->addPanel($panel);
     }
 
     return $curtain;
   }
 
   protected function buildTransactionTimeline(
     PhabricatorApplicationTransactionInterface $object,
     PhabricatorApplicationTransactionQuery $query,
     PhabricatorMarkupEngine $engine = null,
     $render_data = array()) {
 
     $viewer = $this->getRequest()->getUser();
     $xaction = $object->getApplicationTransactionTemplate();
     $view = $xaction->getApplicationTransactionViewObject();
 
     $pager = id(new AphrontCursorPagerView())
       ->readFromRequest($this->getRequest())
       ->setURI(new PhutilURI(
         '/transactions/showolder/'.$object->getPHID().'/'));
 
     $xactions = $query
       ->setViewer($viewer)
       ->withObjectPHIDs(array($object->getPHID()))
       ->needComments(true)
       ->executeWithCursorPager($pager);
     $xactions = array_reverse($xactions);
 
     if ($engine) {
       foreach ($xactions as $xaction) {
         if ($xaction->getComment()) {
           $engine->addObject(
             $xaction->getComment(),
             PhabricatorApplicationTransactionComment::MARKUP_FIELD_COMMENT);
         }
       }
       $engine->process();
       $view->setMarkupEngine($engine);
     }
 
     $timeline = $view
       ->setUser($viewer)
       ->setObjectPHID($object->getPHID())
       ->setTransactions($xactions)
       ->setPager($pager)
       ->setRenderData($render_data)
       ->setQuoteTargetID($this->getRequest()->getStr('quoteTargetID'))
       ->setQuoteRef($this->getRequest()->getStr('quoteRef'));
     $object->willRenderTimeline($timeline, $this->getRequest());
 
     return $timeline;
   }
 
 
   public function buildApplicationCrumbsForEditEngine() {
     // TODO: This is kind of gross, I'm bascially just making this public so
     // I can use it in EditEngine. We could do this without making it public
     // by using controller delegation, or make it properly public.
     return $this->buildApplicationCrumbs();
   }
 
 
 /* -(  Deprecated  )--------------------------------------------------------- */
 
 
   /**
    * DEPRECATED. Use @{method:newPage}.
    */
   public function buildStandardPageView() {
     return $this->newPage();
   }
 
 
   /**
    * DEPRECATED. Use @{method:newPage}.
    */
   public function buildStandardPageResponse($view, array $data) {
     $page = $this->buildStandardPageView();
     $page->appendChild($view);
     return $page->produceAphrontResponse();
   }
 
 }
diff --git a/src/applications/celerity/resources/CelerityResources.php b/src/applications/celerity/resources/CelerityResources.php
index 9536786a6a..e0b9191702 100644
--- a/src/applications/celerity/resources/CelerityResources.php
+++ b/src/applications/celerity/resources/CelerityResources.php
@@ -1,38 +1,38 @@
 <?php
 
 /**
  * Defines the location of static resources.
  */
 abstract class CelerityResources extends Phobject {
 
   abstract public function getName();
   abstract public function getResourceData($name);
 
   public function getResourceModifiedTime($name) {
     return 0;
   }
 
   public function getCelerityHash($data) {
     $tail = PhabricatorEnv::getEnvConfig('celerity.resource-hash');
-    $hash = PhabricatorHash::digest($data, $tail);
+    $hash = PhabricatorHash::weakDigest($data, $tail);
     return substr($hash, 0, 8);
   }
 
   public function getResourceType($path) {
     return CelerityResourceTransformer::getResourceType($path);
   }
 
   public function getResourceURI($hash, $name) {
     $resources = $this->getName();
     return "/res/{$resources}/{$hash}/{$name}";
   }
 
   public function getResourcePackages() {
     return array();
   }
 
   public function loadMap() {
     return array();
   }
 
 }
diff --git a/src/applications/config/check/PhabricatorPathSetupCheck.php b/src/applications/config/check/PhabricatorPathSetupCheck.php
index 9f5502e215..75c89d332a 100644
--- a/src/applications/config/check/PhabricatorPathSetupCheck.php
+++ b/src/applications/config/check/PhabricatorPathSetupCheck.php
@@ -1,136 +1,136 @@
 <?php
 
 final class PhabricatorPathSetupCheck extends PhabricatorSetupCheck {
 
   public function getDefaultGroup() {
     return self::GROUP_OTHER;
   }
 
   protected function executeChecks() {
     // NOTE: We've already appended `environment.append-paths`, so we don't
     // need to explicitly check for it.
     $path = getenv('PATH');
 
     if (!$path) {
       $summary = pht(
         'The environmental variable %s is empty. Phabricator will not '.
         'be able to execute some commands.',
         '$PATH');
 
       $message = pht(
         "The environmental variable %s is empty. Phabricator needs to execute ".
         "some system commands, like `%s`, `%s`, `%s`, and `%s`. To execute ".
         "these commands, the binaries must be available in the webserver's ".
         "%s. You can set additional paths in Phabricator configuration.",
         '$PATH',
         'svn',
         'git',
         'hg',
         'diff',
         '$PATH');
 
       $this
         ->newIssue('config.environment.append-paths')
         ->setName(pht('%s Not Set', '$PATH'))
         ->setSummary($summary)
         ->setMessage($message)
         ->addPhabricatorConfig('environment.append-paths');
 
       // Bail on checks below.
       return;
     }
 
     // Users are remarkably industrious at misconfiguring software. Try to
     // catch mistaken configuration of PATH.
 
     $path_parts = explode(PATH_SEPARATOR, $path);
     $bad_paths = array();
     foreach ($path_parts as $path_part) {
       if (!strlen($path_part)) {
         continue;
       }
 
       $message = null;
       $not_exists = false;
       foreach (Filesystem::walkToRoot($path_part) as $part) {
         if (!Filesystem::pathExists($part)) {
           $not_exists = $part;
           // Walk up so we can tell if this is a readability issue or not.
           continue;
         } else if (!is_dir(Filesystem::resolvePath($part))) {
           $message = pht(
             "The PATH component '%s' (which resolves as the absolute path ".
             "'%s') is not usable because '%s' is not a directory.",
             $path_part,
             Filesystem::resolvePath($path_part),
             $part);
         } else if (!is_readable($part)) {
           $message = pht(
             "The PATH component '%s' (which resolves as the absolute path ".
             "'%s') is not usable because '%s' is not readable.",
             $path_part,
             Filesystem::resolvePath($path_part),
             $part);
         } else if ($not_exists) {
           $message = pht(
             "The PATH component '%s' (which resolves as the absolute path ".
             "'%s') is not usable because '%s' does not exist.",
             $path_part,
             Filesystem::resolvePath($path_part),
             $not_exists);
         } else {
           // Everything seems good.
           break;
         }
 
         if ($message !== null) {
           break;
         }
       }
 
       if ($message === null) {
         if (!phutil_is_windows() && !@file_exists($path_part.'/.')) {
           $message = pht(
             "The PATH component '%s' (which resolves as the absolute path ".
             "'%s') is not usable because it is not traversable (its '%s' ".
             "permission bit is not set).",
             $path_part,
             Filesystem::resolvePath($path_part),
             '+x');
         }
       }
 
       if ($message !== null) {
         $bad_paths[$path_part] = $message;
       }
     }
 
     if ($bad_paths) {
       foreach ($bad_paths as $path_part => $message) {
-        $digest = substr(PhabricatorHash::digest($path_part), 0, 8);
+        $digest = substr(PhabricatorHash::weakDigest($path_part), 0, 8);
 
         $this
           ->newIssue('config.PATH.'.$digest)
           ->setName(pht('%s Component Unusable', '$PATH'))
           ->setSummary(
             pht(
               'A component of the configured PATH can not be used by '.
               'the webserver: %s',
               $path_part))
           ->setMessage(
             pht(
               "The configured PATH includes a component which is not usable. ".
               "Phabricator will be unable to find or execute binaries located ".
               "here:".
               "\n\n".
               "%s".
               "\n\n".
               "The user that the webserver runs as must be able to read all ".
               "the directories in PATH in order to make use of them.",
               $message))
           ->addPhabricatorConfig('environment.append-paths');
       }
     }
 
   }
 }
diff --git a/src/applications/diffusion/controller/DiffusionServeController.php b/src/applications/diffusion/controller/DiffusionServeController.php
index 02ff23b15f..5e61ae3a7c 100644
--- a/src/applications/diffusion/controller/DiffusionServeController.php
+++ b/src/applications/diffusion/controller/DiffusionServeController.php
@@ -1,1233 +1,1233 @@
 <?php
 
 final class DiffusionServeController extends DiffusionController {
 
   private $serviceViewer;
   private $serviceRepository;
 
   private $isGitLFSRequest;
   private $gitLFSToken;
   private $gitLFSInput;
 
   public function setServiceViewer(PhabricatorUser $viewer) {
     $this->getRequest()->setUser($viewer);
 
     $this->serviceViewer = $viewer;
     return $this;
   }
 
   public function getServiceViewer() {
     return $this->serviceViewer;
   }
 
   public function setServiceRepository(PhabricatorRepository $repository) {
     $this->serviceRepository = $repository;
     return $this;
   }
 
   public function getServiceRepository() {
     return $this->serviceRepository;
   }
 
   public function getIsGitLFSRequest() {
     return $this->isGitLFSRequest;
   }
 
   public function getGitLFSToken() {
     return $this->gitLFSToken;
   }
 
   public function isVCSRequest(AphrontRequest $request) {
     $identifier = $this->getRepositoryIdentifierFromRequest($request);
     if ($identifier === null) {
       return null;
     }
 
     $content_type = $request->getHTTPHeader('Content-Type');
     $user_agent = idx($_SERVER, 'HTTP_USER_AGENT');
     $request_type = $request->getHTTPHeader('X-Phabricator-Request-Type');
 
     // This may have a "charset" suffix, so only match the prefix.
     $lfs_pattern = '(^application/vnd\\.git-lfs\\+json(;|\z))';
 
     $vcs = null;
     if ($request->getExists('service')) {
       $service = $request->getStr('service');
       // We get this initially for `info/refs`.
       // Git also gives us a User-Agent like "git/1.8.2.3".
       $vcs = PhabricatorRepositoryType::REPOSITORY_TYPE_GIT;
     } else if (strncmp($user_agent, 'git/', 4) === 0) {
       $vcs = PhabricatorRepositoryType::REPOSITORY_TYPE_GIT;
     } else if ($content_type == 'application/x-git-upload-pack-request') {
       // We get this for `git-upload-pack`.
       $vcs = PhabricatorRepositoryType::REPOSITORY_TYPE_GIT;
     } else if ($content_type == 'application/x-git-receive-pack-request') {
       // We get this for `git-receive-pack`.
       $vcs = PhabricatorRepositoryType::REPOSITORY_TYPE_GIT;
     } else if (preg_match($lfs_pattern, $content_type)) {
       // This is a Git LFS HTTP API request.
       $vcs = PhabricatorRepositoryType::REPOSITORY_TYPE_GIT;
       $this->isGitLFSRequest = true;
     } else if ($request_type == 'git-lfs') {
       // This is a Git LFS object content request.
       $vcs = PhabricatorRepositoryType::REPOSITORY_TYPE_GIT;
       $this->isGitLFSRequest = true;
     } else if ($request->getExists('cmd')) {
       // Mercurial also sends an Accept header like
       // "application/mercurial-0.1", and a User-Agent like
       // "mercurial/proto-1.0".
       $vcs = PhabricatorRepositoryType::REPOSITORY_TYPE_MERCURIAL;
     } else {
       // Subversion also sends an initial OPTIONS request (vs GET/POST), and
       // has a User-Agent like "SVN/1.8.3 (x86_64-apple-darwin11.4.2)
       // serf/1.3.2".
       $dav = $request->getHTTPHeader('DAV');
       $dav = new PhutilURI($dav);
       if ($dav->getDomain() === 'subversion.tigris.org') {
         $vcs = PhabricatorRepositoryType::REPOSITORY_TYPE_SVN;
       }
     }
 
     return $vcs;
   }
 
   public function handleRequest(AphrontRequest $request) {
     $service_exception = null;
     $response = null;
 
     try {
       $response = $this->serveRequest($request);
     } catch (Exception $ex) {
       $service_exception = $ex;
     }
 
     try {
       $remote_addr = $request->getRemoteAddress();
 
       $pull_event = id(new PhabricatorRepositoryPullEvent())
         ->setEpoch(PhabricatorTime::getNow())
         ->setRemoteAddress($remote_addr)
         ->setRemoteProtocol('http');
 
       if ($response) {
         $pull_event
           ->setResultType('wild')
           ->setResultCode($response->getHTTPResponseCode());
 
         if ($response instanceof PhabricatorVCSResponse) {
           $pull_event->setProperties(
             array(
               'response.message' => $response->getMessage(),
             ));
         }
       } else {
         $pull_event
           ->setResultType('exception')
           ->setResultCode(500)
           ->setProperties(
             array(
               'exception.class' => get_class($ex),
               'exception.message' => $ex->getMessage(),
             ));
       }
 
       $viewer = $this->getServiceViewer();
       if ($viewer) {
         $pull_event->setPullerPHID($viewer->getPHID());
       }
 
       $repository = $this->getServiceRepository();
       if ($repository) {
         $pull_event->setRepositoryPHID($repository->getPHID());
       }
 
       $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
         $pull_event->save();
       unset($unguarded);
 
     } catch (Exception $ex) {
       if ($service_exception) {
         throw $service_exception;
       }
       throw $ex;
     }
 
     if ($service_exception) {
       throw $service_exception;
     }
 
     return $response;
   }
 
   private function serveRequest(AphrontRequest $request) {
     $identifier = $this->getRepositoryIdentifierFromRequest($request);
 
     // If authentication credentials have been provided, try to find a user
     // that actually matches those credentials.
 
     // We require both the username and password to be nonempty, because Git
     // won't prompt users who provide a username but no password otherwise.
     // See T10797 for discussion.
 
     $have_user = strlen(idx($_SERVER, 'PHP_AUTH_USER'));
     $have_pass = strlen(idx($_SERVER, 'PHP_AUTH_PW'));
     if ($have_user && $have_pass) {
       $username = $_SERVER['PHP_AUTH_USER'];
       $password = new PhutilOpaqueEnvelope($_SERVER['PHP_AUTH_PW']);
 
       // Try Git LFS auth first since we can usually reject it without doing
       // any queries, since the username won't match the one we expect or the
       // request won't be LFS.
       $viewer = $this->authenticateGitLFSUser($username, $password);
 
       // If that failed, try normal auth. Note that we can use normal auth on
       // LFS requests, so this isn't strictly an alternative to LFS auth.
       if (!$viewer) {
         $viewer = $this->authenticateHTTPRepositoryUser($username, $password);
       }
 
       if (!$viewer) {
         return new PhabricatorVCSResponse(
           403,
           pht('Invalid credentials.'));
       }
     } else {
       // User hasn't provided credentials, which means we count them as
       // being "not logged in".
       $viewer = new PhabricatorUser();
     }
 
     $this->setServiceViewer($viewer);
 
     $allow_public = PhabricatorEnv::getEnvConfig('policy.allow-public');
     $allow_auth = PhabricatorEnv::getEnvConfig('diffusion.allow-http-auth');
     if (!$allow_public) {
       if (!$viewer->isLoggedIn()) {
         if ($allow_auth) {
           return new PhabricatorVCSResponse(
             401,
             pht('You must log in to access repositories.'));
         } else {
           return new PhabricatorVCSResponse(
             403,
             pht('Public and authenticated HTTP access are both forbidden.'));
         }
       }
     }
 
     try {
       $repository = id(new PhabricatorRepositoryQuery())
         ->setViewer($viewer)
         ->withIdentifiers(array($identifier))
         ->needURIs(true)
         ->executeOne();
       if (!$repository) {
         return new PhabricatorVCSResponse(
           404,
           pht('No such repository exists.'));
       }
     } catch (PhabricatorPolicyException $ex) {
       if ($viewer->isLoggedIn()) {
         return new PhabricatorVCSResponse(
           403,
           pht('You do not have permission to access this repository.'));
       } else {
         if ($allow_auth) {
           return new PhabricatorVCSResponse(
             401,
             pht('You must log in to access this repository.'));
         } else {
           return new PhabricatorVCSResponse(
             403,
             pht(
               'This repository requires authentication, which is forbidden '.
               'over HTTP.'));
         }
       }
     }
 
     $response = $this->validateGitLFSRequest($repository, $viewer);
     if ($response) {
       return $response;
     }
 
     $this->setServiceRepository($repository);
 
     if (!$repository->isTracked()) {
       return new PhabricatorVCSResponse(
         403,
         pht('This repository is inactive.'));
     }
 
     $is_push = !$this->isReadOnlyRequest($repository);
 
     if ($this->getIsGitLFSRequest() && $this->getGitLFSToken()) {
       // We allow git LFS requests over HTTP even if the repository does not
       // otherwise support HTTP reads or writes, as long as the user is using a
       // token from SSH. If they're using HTTP username + password auth, they
       // have to obey the normal HTTP rules.
     } else {
       // For now, we don't distinguish between HTTP and HTTPS-originated
       // requests that are proxied within the cluster, so the user can connect
       // with HTTPS but we may be on HTTP by the time we reach this part of
       // the code. Allow things to move forward as long as either protocol
       // can be served.
       $proto_https = PhabricatorRepositoryURI::BUILTIN_PROTOCOL_HTTPS;
       $proto_http = PhabricatorRepositoryURI::BUILTIN_PROTOCOL_HTTP;
 
       $can_read =
         $repository->canServeProtocol($proto_https, false) ||
         $repository->canServeProtocol($proto_http, false);
       if (!$can_read) {
         return new PhabricatorVCSResponse(
           403,
           pht('This repository is not available over HTTP.'));
       }
 
       if ($is_push) {
         $can_write =
           $repository->canServeProtocol($proto_https, true) ||
           $repository->canServeProtocol($proto_http, true);
         if (!$can_write) {
           return new PhabricatorVCSResponse(
             403,
             pht('This repository is read-only over HTTP.'));
         }
       }
     }
 
     if ($is_push) {
       $can_push = PhabricatorPolicyFilter::hasCapability(
         $viewer,
         $repository,
         DiffusionPushCapability::CAPABILITY);
       if (!$can_push) {
         if ($viewer->isLoggedIn()) {
           $error_code = 403;
           $error_message = pht(
             'You do not have permission to push to this repository ("%s").',
             $repository->getDisplayName());
 
           if ($this->getIsGitLFSRequest()) {
             return DiffusionGitLFSResponse::newErrorResponse(
               $error_code,
               $error_message);
           } else {
             return new PhabricatorVCSResponse(
               $error_code,
               $error_message);
           }
         } else {
           if ($allow_auth) {
             return new PhabricatorVCSResponse(
               401,
               pht('You must log in to push to this repository.'));
           } else {
             return new PhabricatorVCSResponse(
               403,
               pht(
                 'Pushing to this repository requires authentication, '.
                 'which is forbidden over HTTP.'));
           }
         }
       }
     }
 
     $vcs_type = $repository->getVersionControlSystem();
     $req_type = $this->isVCSRequest($request);
 
     if ($vcs_type != $req_type) {
       switch ($req_type) {
         case PhabricatorRepositoryType::REPOSITORY_TYPE_GIT:
           $result = new PhabricatorVCSResponse(
             500,
             pht(
               'This repository ("%s") is not a Git repository.',
               $repository->getDisplayName()));
           break;
         case PhabricatorRepositoryType::REPOSITORY_TYPE_MERCURIAL:
           $result = new PhabricatorVCSResponse(
             500,
             pht(
               'This repository ("%s") is not a Mercurial repository.',
               $repository->getDisplayName()));
           break;
         case PhabricatorRepositoryType::REPOSITORY_TYPE_SVN:
           $result = new PhabricatorVCSResponse(
             500,
             pht(
               'This repository ("%s") is not a Subversion repository.',
               $repository->getDisplayName()));
           break;
         default:
           $result = new PhabricatorVCSResponse(
             500,
             pht('Unknown request type.'));
           break;
       }
     } else {
       switch ($vcs_type) {
         case PhabricatorRepositoryType::REPOSITORY_TYPE_GIT:
         case PhabricatorRepositoryType::REPOSITORY_TYPE_MERCURIAL:
           $result = $this->serveVCSRequest($repository, $viewer);
           break;
         case PhabricatorRepositoryType::REPOSITORY_TYPE_SVN:
           $result = new PhabricatorVCSResponse(
             500,
             pht(
               'Phabricator does not support HTTP access to Subversion '.
               'repositories.'));
           break;
         default:
           $result = new PhabricatorVCSResponse(
             500,
             pht('Unknown version control system.'));
           break;
       }
     }
 
     $code = $result->getHTTPResponseCode();
 
     if ($is_push && ($code == 200)) {
       $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
         $repository->writeStatusMessage(
           PhabricatorRepositoryStatusMessage::TYPE_NEEDS_UPDATE,
           PhabricatorRepositoryStatusMessage::CODE_OKAY);
       unset($unguarded);
     }
 
     return $result;
   }
 
   private function serveVCSRequest(
     PhabricatorRepository $repository,
     PhabricatorUser $viewer) {
 
     // We can serve Git LFS requests first, since we don't need to proxy them.
     // It's also important that LFS requests never fall through to standard
     // service pathways, because that would let you use LFS tokens to read
     // normal repository data.
     if ($this->getIsGitLFSRequest()) {
       return $this->serveGitLFSRequest($repository, $viewer);
     }
 
     // If this repository is hosted on a service, we need to proxy the request
     // to a host which can serve it.
     $is_cluster_request = $this->getRequest()->isProxiedClusterRequest();
 
     $uri = $repository->getAlmanacServiceURI(
       $viewer,
       $is_cluster_request,
       array(
         'http',
         'https',
       ));
     if ($uri) {
       $future = $this->getRequest()->newClusterProxyFuture($uri);
       return id(new AphrontHTTPProxyResponse())
         ->setHTTPFuture($future);
     }
 
     // Otherwise, we're going to handle the request locally.
 
     $vcs_type = $repository->getVersionControlSystem();
     switch ($vcs_type) {
       case PhabricatorRepositoryType::REPOSITORY_TYPE_GIT:
         $result = $this->serveGitRequest($repository, $viewer);
         break;
       case PhabricatorRepositoryType::REPOSITORY_TYPE_MERCURIAL:
         $result = $this->serveMercurialRequest($repository, $viewer);
         break;
     }
 
     return $result;
   }
 
   private function isReadOnlyRequest(
     PhabricatorRepository $repository) {
     $request = $this->getRequest();
     $method = $_SERVER['REQUEST_METHOD'];
 
     // TODO: This implementation is safe by default, but very incomplete.
 
     if ($this->getIsGitLFSRequest()) {
       return $this->isGitLFSReadOnlyRequest($repository);
     }
 
     switch ($repository->getVersionControlSystem()) {
       case PhabricatorRepositoryType::REPOSITORY_TYPE_GIT:
         $service = $request->getStr('service');
         $path = $this->getRequestDirectoryPath($repository);
         // NOTE: Service names are the reverse of what you might expect, as they
         // are from the point of view of the server. The main read service is
         // "git-upload-pack", and the main write service is "git-receive-pack".
 
         if ($method == 'GET' &&
             $path == '/info/refs' &&
             $service == 'git-upload-pack') {
           return true;
         }
 
         if ($path == '/git-upload-pack') {
           return true;
         }
 
         break;
       case PhabricatorRepositoryType::REPOSITORY_TYPE_MERCURIAL:
         $cmd = $request->getStr('cmd');
         if ($cmd == 'batch') {
           $cmds = idx($this->getMercurialArguments(), 'cmds');
           return DiffusionMercurialWireProtocol::isReadOnlyBatchCommand($cmds);
         }
         return DiffusionMercurialWireProtocol::isReadOnlyCommand($cmd);
       case PhabricatorRepositoryType::REPOSITORY_TYPE_SVN:
         break;
     }
 
     return false;
   }
 
   /**
    * @phutil-external-symbol class PhabricatorStartup
    */
   private function serveGitRequest(
     PhabricatorRepository $repository,
     PhabricatorUser $viewer) {
     $request = $this->getRequest();
 
     $request_path = $this->getRequestDirectoryPath($repository);
     $repository_root = $repository->getLocalPath();
 
     // Rebuild the query string to strip `__magic__` parameters and prevent
     // issues where we might interpret inputs like "service=read&service=write"
     // differently than the server does and pass it an unsafe command.
 
     // NOTE: This does not use getPassthroughRequestParameters() because
     // that code is HTTP-method agnostic and will encode POST data.
 
     $query_data = $_GET;
     foreach ($query_data as $key => $value) {
       if (!strncmp($key, '__', 2)) {
         unset($query_data[$key]);
       }
     }
     $query_string = http_build_query($query_data, '', '&');
 
     // We're about to wipe out PATH with the rest of the environment, so
     // resolve the binary first.
     $bin = Filesystem::resolveBinary('git-http-backend');
     if (!$bin) {
       throw new Exception(
         pht(
           'Unable to find `%s` in %s!',
           'git-http-backend',
           '$PATH'));
     }
 
     // NOTE: We do not set HTTP_CONTENT_ENCODING here, because we already
     // decompressed the request when we read the request body, so the body is
     // just plain data with no encoding.
 
     $env = array(
       'REQUEST_METHOD' => $_SERVER['REQUEST_METHOD'],
       'QUERY_STRING' => $query_string,
       'CONTENT_TYPE' => $request->getHTTPHeader('Content-Type'),
       'REMOTE_ADDR' => $_SERVER['REMOTE_ADDR'],
       'GIT_PROJECT_ROOT' => $repository_root,
       'GIT_HTTP_EXPORT_ALL' => '1',
       'PATH_INFO' => $request_path,
 
       'REMOTE_USER' => $viewer->getUsername(),
 
       // TODO: Set these correctly.
       // GIT_COMMITTER_NAME
       // GIT_COMMITTER_EMAIL
     ) + $this->getCommonEnvironment($viewer);
 
     $input = PhabricatorStartup::getRawInput();
 
     $command = csprintf('%s', $bin);
     $command = PhabricatorDaemon::sudoCommandAsDaemonUser($command);
 
     $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
 
     $cluster_engine = id(new DiffusionRepositoryClusterEngine())
       ->setViewer($viewer)
       ->setRepository($repository);
 
     $did_write_lock = false;
     if ($this->isReadOnlyRequest($repository)) {
       $cluster_engine->synchronizeWorkingCopyBeforeRead();
     } else {
       $did_write_lock = true;
       $cluster_engine->synchronizeWorkingCopyBeforeWrite();
     }
 
     $caught = null;
     try {
       list($err, $stdout, $stderr) = id(new ExecFuture('%C', $command))
         ->setEnv($env, true)
         ->write($input)
         ->resolve();
     } catch (Exception $ex) {
       $caught = $ex;
     }
 
     if ($did_write_lock) {
       $cluster_engine->synchronizeWorkingCopyAfterWrite();
     }
 
     unset($unguarded);
 
     if ($caught) {
       throw $caught;
     }
 
     if ($err) {
       if ($this->isValidGitShallowCloneResponse($stdout, $stderr)) {
         // Ignore the error if the response passes this special check for
         // validity.
         $err = 0;
       }
     }
 
     if ($err) {
       return new PhabricatorVCSResponse(
         500,
         pht(
           'Error %d: %s',
           $err,
           phutil_utf8ize($stderr)));
     }
 
     return id(new DiffusionGitResponse())->setGitData($stdout);
   }
 
   private function getRequestDirectoryPath(PhabricatorRepository $repository) {
     $request = $this->getRequest();
     $request_path = $request->getRequestURI()->getPath();
 
     $info = PhabricatorRepository::parseRepositoryServicePath(
       $request_path,
       $repository->getVersionControlSystem());
     $base_path = $info['path'];
 
     // For Git repositories, strip an optional directory component if it
     // isn't the name of a known Git resource. This allows users to clone
     // repositories as "/diffusion/X/anything.git", for example.
     if ($repository->isGit()) {
       $known = array(
         'info',
         'git-upload-pack',
         'git-receive-pack',
       );
 
       foreach ($known as $key => $path) {
         $known[$key] = preg_quote($path, '@');
       }
 
       $known = implode('|', $known);
 
       if (preg_match('@^/([^/]+)/('.$known.')(/|$)@', $base_path)) {
         $base_path = preg_replace('@^/([^/]+)@', '', $base_path);
       }
     }
 
     return $base_path;
   }
 
   private function authenticateGitLFSUser(
     $username,
     PhutilOpaqueEnvelope $password) {
 
     // Never accept these credentials for requests which aren't LFS requests.
     if (!$this->getIsGitLFSRequest()) {
       return null;
     }
 
     // If we have the wrong username, don't bother checking if the token
     // is right.
     if ($username !== DiffusionGitLFSTemporaryTokenType::HTTP_USERNAME) {
       return null;
     }
 
     $lfs_pass = $password->openEnvelope();
-    $lfs_hash = PhabricatorHash::digest($lfs_pass);
+    $lfs_hash = PhabricatorHash::weakDigest($lfs_pass);
 
     $token = id(new PhabricatorAuthTemporaryTokenQuery())
       ->setViewer(PhabricatorUser::getOmnipotentUser())
       ->withTokenTypes(array(DiffusionGitLFSTemporaryTokenType::TOKENTYPE))
       ->withTokenCodes(array($lfs_hash))
       ->withExpired(false)
       ->executeOne();
     if (!$token) {
       return null;
     }
 
     $user = id(new PhabricatorPeopleQuery())
       ->setViewer(PhabricatorUser::getOmnipotentUser())
       ->withPHIDs(array($token->getUserPHID()))
       ->executeOne();
 
     if (!$user) {
       return null;
     }
 
     if (!$user->isUserActivated()) {
       return null;
     }
 
     $this->gitLFSToken = $token;
 
     return $user;
   }
 
   private function authenticateHTTPRepositoryUser(
     $username,
     PhutilOpaqueEnvelope $password) {
 
     if (!PhabricatorEnv::getEnvConfig('diffusion.allow-http-auth')) {
       // No HTTP auth permitted.
       return null;
     }
 
     if (!strlen($username)) {
       // No username.
       return null;
     }
 
     if (!strlen($password->openEnvelope())) {
       // No password.
       return null;
     }
 
     $user = id(new PhabricatorPeopleQuery())
       ->setViewer(PhabricatorUser::getOmnipotentUser())
       ->withUsernames(array($username))
       ->executeOne();
     if (!$user) {
       // Username doesn't match anything.
       return null;
     }
 
     if (!$user->isUserActivated()) {
       // User is not activated.
       return null;
     }
 
     $password_entry = id(new PhabricatorRepositoryVCSPassword())
       ->loadOneWhere('userPHID = %s', $user->getPHID());
     if (!$password_entry) {
       // User doesn't have a password set.
       return null;
     }
 
     if (!$password_entry->comparePassword($password, $user)) {
       // Password doesn't match.
       return null;
     }
 
     // If the user's password is stored using a less-than-optimal hash, upgrade
     // them to the strongest available hash.
 
     $hash_envelope = new PhutilOpaqueEnvelope(
       $password_entry->getPasswordHash());
     if (PhabricatorPasswordHasher::canUpgradeHash($hash_envelope)) {
       $password_entry->setPassword($password, $user);
       $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
         $password_entry->save();
       unset($unguarded);
     }
 
     return $user;
   }
 
   private function serveMercurialRequest(
     PhabricatorRepository $repository,
     PhabricatorUser $viewer) {
     $request = $this->getRequest();
 
     $bin = Filesystem::resolveBinary('hg');
     if (!$bin) {
       throw new Exception(
         pht(
           'Unable to find `%s` in %s!',
           'hg',
           '$PATH'));
     }
 
     $env = $this->getCommonEnvironment($viewer);
     $input = PhabricatorStartup::getRawInput();
 
     $cmd = $request->getStr('cmd');
 
     $args = $this->getMercurialArguments();
     $args = $this->formatMercurialArguments($cmd, $args);
 
     if (strlen($input)) {
       $input = strlen($input)."\n".$input."0\n";
     }
 
     $command = csprintf('%s serve --stdio', $bin);
     $command = PhabricatorDaemon::sudoCommandAsDaemonUser($command);
 
     list($err, $stdout, $stderr) = id(new ExecFuture('%C', $command))
       ->setEnv($env, true)
       ->setCWD($repository->getLocalPath())
       ->write("{$cmd}\n{$args}{$input}")
       ->resolve();
 
     if ($err) {
       return new PhabricatorVCSResponse(
         500,
         pht('Error %d: %s', $err, $stderr));
     }
 
     if ($cmd == 'getbundle' ||
         $cmd == 'changegroup' ||
         $cmd == 'changegroupsubset') {
       // We're not completely sure that "changegroup" and "changegroupsubset"
       // actually work, they're for very old Mercurial.
       $body = gzcompress($stdout);
     } else if ($cmd == 'unbundle') {
       // This includes diagnostic information and anything echoed by commit
       // hooks. We ignore `stdout` since it just has protocol garbage, and
       // substitute `stderr`.
       $body = strlen($stderr)."\n".$stderr;
     } else {
       list($length, $body) = explode("\n", $stdout, 2);
       if ($cmd == 'capabilities') {
         $body = DiffusionMercurialWireProtocol::filterBundle2Capability($body);
       }
     }
 
     return id(new DiffusionMercurialResponse())->setContent($body);
   }
 
   private function getMercurialArguments() {
     // Mercurial sends arguments in HTTP headers. "Why?", you might wonder,
     // "Why would you do this?".
 
     $args_raw = array();
     for ($ii = 1;; $ii++) {
       $header = 'HTTP_X_HGARG_'.$ii;
       if (!array_key_exists($header, $_SERVER)) {
         break;
       }
       $args_raw[] = $_SERVER[$header];
     }
     $args_raw = implode('', $args_raw);
 
     return id(new PhutilQueryStringParser())
       ->parseQueryString($args_raw);
   }
 
   private function formatMercurialArguments($command, array $arguments) {
     $spec = DiffusionMercurialWireProtocol::getCommandArgs($command);
 
     $out = array();
 
     // Mercurial takes normal arguments like this:
     //
     //   name <length(value)>
     //   value
 
     $has_star = false;
     foreach ($spec as $arg_key) {
       if ($arg_key == '*') {
         $has_star = true;
         continue;
       }
       if (isset($arguments[$arg_key])) {
         $value = $arguments[$arg_key];
         $size = strlen($value);
         $out[] = "{$arg_key} {$size}\n{$value}";
         unset($arguments[$arg_key]);
       }
     }
 
     if ($has_star) {
 
       // Mercurial takes arguments for variable argument lists roughly like
       // this:
       //
       //   * <count(args)>
       //   argname1 <length(argvalue1)>
       //   argvalue1
       //   argname2 <length(argvalue2)>
       //   argvalue2
 
       $count = count($arguments);
 
       $out[] = "* {$count}\n";
 
       foreach ($arguments as $key => $value) {
         if (in_array($key, $spec)) {
           // We already added this argument above, so skip it.
           continue;
         }
         $size = strlen($value);
         $out[] = "{$key} {$size}\n{$value}";
       }
     }
 
     return implode('', $out);
   }
 
   private function isValidGitShallowCloneResponse($stdout, $stderr) {
     // If you execute `git clone --depth N ...`, git sends a request which
     // `git-http-backend` responds to by emitting valid output and then exiting
     // with a failure code and an error message. If we ignore this error,
     // everything works.
 
     // This is a pretty funky fix: it would be nice to more precisely detect
     // that a request is a `--depth N` clone request, but we don't have any code
     // to decode protocol frames yet. Instead, look for reasonable evidence
     // in the error and output that we're looking at a `--depth` clone.
 
     // For evidence this isn't completely crazy, see:
     // https://github.com/schacon/grack/pull/7
 
     $stdout_regexp = '(^Content-Type: application/x-git-upload-pack-result)m';
     $stderr_regexp = '(The remote end hung up unexpectedly)';
 
     $has_pack = preg_match($stdout_regexp, $stdout);
     $is_hangup = preg_match($stderr_regexp, $stderr);
 
     return $has_pack && $is_hangup;
   }
 
   private function getCommonEnvironment(PhabricatorUser $viewer) {
     $remote_address = $this->getRequest()->getRemoteAddress();
 
     return array(
       DiffusionCommitHookEngine::ENV_USER => $viewer->getUsername(),
       DiffusionCommitHookEngine::ENV_REMOTE_ADDRESS => $remote_address,
       DiffusionCommitHookEngine::ENV_REMOTE_PROTOCOL => 'http',
     );
   }
 
   private function validateGitLFSRequest(
     PhabricatorRepository $repository,
     PhabricatorUser $viewer) {
     if (!$this->getIsGitLFSRequest()) {
       return null;
     }
 
     if (!$repository->canUseGitLFS()) {
       return new PhabricatorVCSResponse(
         403,
         pht(
           'The requested repository ("%s") does not support Git LFS.',
           $repository->getDisplayName()));
     }
 
     // If this is using an LFS token, sanity check that we're using it on the
     // correct repository. This shouldn't really matter since the user could
     // just request a proper token anyway, but it suspicious and should not
     // be permitted.
 
     $token = $this->getGitLFSToken();
     if ($token) {
       $resource = $token->getTokenResource();
       if ($resource !== $repository->getPHID()) {
         return new PhabricatorVCSResponse(
           403,
           pht(
             'The authentication token provided in the request is bound to '.
             'a different repository than the requested repository ("%s").',
             $repository->getDisplayName()));
       }
     }
 
     return null;
   }
 
   private function serveGitLFSRequest(
     PhabricatorRepository $repository,
     PhabricatorUser $viewer) {
 
     if (!$this->getIsGitLFSRequest()) {
       throw new Exception(pht('This is not a Git LFS request!'));
     }
 
     $path = $this->getGitLFSRequestPath($repository);
     $matches = null;
 
     if (preg_match('(^upload/(.*)\z)', $path, $matches)) {
       $oid = $matches[1];
       return $this->serveGitLFSUploadRequest($repository, $viewer, $oid);
     } else if ($path == 'objects/batch') {
       return $this->serveGitLFSBatchRequest($repository, $viewer);
     } else {
       return DiffusionGitLFSResponse::newErrorResponse(
         404,
         pht(
           'Git LFS operation "%s" is not supported by this server.',
           $path));
     }
   }
 
   private function serveGitLFSBatchRequest(
     PhabricatorRepository $repository,
     PhabricatorUser $viewer) {
 
     $input = $this->getGitLFSInput();
 
     $operation = idx($input, 'operation');
     switch ($operation) {
       case 'upload':
         $want_upload = true;
         break;
       case 'download':
         $want_upload = false;
         break;
       default:
         return DiffusionGitLFSResponse::newErrorResponse(
           404,
           pht(
             'Git LFS batch operation "%s" is not supported by this server.',
             $operation));
     }
 
     $objects = idx($input, 'objects', array());
 
     $hashes = array();
     foreach ($objects as $object) {
       $hashes[] = idx($object, 'oid');
     }
 
     if ($hashes) {
       $refs = id(new PhabricatorRepositoryGitLFSRefQuery())
         ->setViewer($viewer)
         ->withRepositoryPHIDs(array($repository->getPHID()))
         ->withObjectHashes($hashes)
         ->execute();
       $refs = mpull($refs, null, 'getObjectHash');
     } else {
       $refs = array();
     }
 
     $file_phids = mpull($refs, 'getFilePHID');
     if ($file_phids) {
       $files = id(new PhabricatorFileQuery())
         ->setViewer($viewer)
         ->withPHIDs($file_phids)
         ->execute();
       $files = mpull($files, null, 'getPHID');
     } else {
       $files = array();
     }
 
     $authorization = null;
     $output = array();
     foreach ($objects as $object) {
       $oid = idx($object, 'oid');
       $size = idx($object, 'size');
       $ref = idx($refs, $oid);
       $error = null;
 
       // NOTE: If we already have a ref for this object, we only emit a
       // "download" action. The client should not upload the file again.
 
       $actions = array();
       if ($ref) {
         $file = idx($files, $ref->getFilePHID());
         if ($file) {
           // Git LFS may prompt users for authentication if the action does
           // not provide an "Authorization" header and does not have a query
           // parameter named "token". See here for discussion:
           // <https://github.com/github/git-lfs/issues/1088>
           $no_authorization = 'Basic '.base64_encode('none');
 
           $get_uri = $file->getCDNURI();
           $actions['download'] = array(
             'href' => $get_uri,
             'header' => array(
               'Authorization' => $no_authorization,
               'X-Phabricator-Request-Type' => 'git-lfs',
             ),
           );
         } else {
           $error = array(
             'code' => 404,
             'message' => pht(
               'Object "%s" was previously uploaded, but no longer exists '.
               'on this server.',
               $oid),
           );
         }
       } else if ($want_upload) {
         if (!$authorization) {
           // Here, we could reuse the existing authorization if we have one,
           // but it's a little simpler to just generate a new one
           // unconditionally.
           $authorization = $this->newGitLFSHTTPAuthorization(
             $repository,
             $viewer,
             $operation);
         }
 
         $put_uri = $repository->getGitLFSURI("info/lfs/upload/{$oid}");
 
         $actions['upload'] = array(
           'href' => $put_uri,
           'header' => array(
             'Authorization' => $authorization,
             'X-Phabricator-Request-Type' => 'git-lfs',
           ),
         );
       }
 
       $object = array(
         'oid' => $oid,
         'size' => $size,
       );
 
       if ($actions) {
         $object['actions'] = $actions;
       }
 
       if ($error) {
         $object['error'] = $error;
       }
 
       $output[] = $object;
     }
 
     $output = array(
       'objects' => $output,
     );
 
     return id(new DiffusionGitLFSResponse())
       ->setContent($output);
   }
 
   private function serveGitLFSUploadRequest(
     PhabricatorRepository $repository,
     PhabricatorUser $viewer,
     $oid) {
 
     $ref = id(new PhabricatorRepositoryGitLFSRefQuery())
       ->setViewer($viewer)
       ->withRepositoryPHIDs(array($repository->getPHID()))
       ->withObjectHashes(array($oid))
       ->executeOne();
     if ($ref) {
       return DiffusionGitLFSResponse::newErrorResponse(
         405,
         pht(
           'Content for object "%s" is already known to this server. It can '.
           'not be uploaded again.',
           $oid));
     }
 
     // Remove the execution time limit because uploading large files may take
     // a while.
     set_time_limit(0);
 
     $request_stream = new AphrontRequestStream();
     $request_iterator = $request_stream->getIterator();
     $hashing_iterator = id(new PhutilHashingIterator($request_iterator))
       ->setAlgorithm('sha256');
 
     $source = id(new PhabricatorIteratorFileUploadSource())
       ->setName('lfs-'.$oid)
       ->setViewPolicy(PhabricatorPolicies::POLICY_NOONE)
       ->setIterator($hashing_iterator);
 
     $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
       $file = $source->uploadFile();
     unset($unguarded);
 
     $hash = $hashing_iterator->getHash();
     if ($hash !== $oid) {
       return DiffusionGitLFSResponse::newErrorResponse(
         400,
         pht(
           'Uploaded data is corrupt or invalid. Expected hash "%s", actual '.
           'hash "%s".',
           $oid,
           $hash));
     }
 
     $ref = id(new PhabricatorRepositoryGitLFSRef())
       ->setRepositoryPHID($repository->getPHID())
       ->setObjectHash($hash)
       ->setByteSize($file->getByteSize())
       ->setAuthorPHID($viewer->getPHID())
       ->setFilePHID($file->getPHID());
 
     $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
       // Attach the file to the repository to give users permission
       // to access it.
       $file->attachToObject($repository->getPHID());
       $ref->save();
     unset($unguarded);
 
     // This is just a plain HTTP 200 with no content, which is what `git lfs`
     // expects.
     return new DiffusionGitLFSResponse();
   }
 
   private function newGitLFSHTTPAuthorization(
     PhabricatorRepository $repository,
     PhabricatorUser $viewer,
     $operation) {
 
     $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
 
     $authorization = DiffusionGitLFSTemporaryTokenType::newHTTPAuthorization(
       $repository,
       $viewer,
       $operation);
 
     unset($unguarded);
 
     return $authorization;
   }
 
   private function getGitLFSRequestPath(PhabricatorRepository $repository) {
     $request_path = $this->getRequestDirectoryPath($repository);
 
     $matches = null;
     if (preg_match('(^/info/lfs(?:\z|/)(.*))', $request_path, $matches)) {
       return $matches[1];
     }
 
     return null;
   }
 
   private function getGitLFSInput() {
     if (!$this->gitLFSInput) {
       $input = PhabricatorStartup::getRawInput();
       $input = phutil_json_decode($input);
       $this->gitLFSInput = $input;
     }
 
     return $this->gitLFSInput;
   }
 
   private function isGitLFSReadOnlyRequest(PhabricatorRepository $repository) {
     if (!$this->getIsGitLFSRequest()) {
       return false;
     }
 
     $path = $this->getGitLFSRequestPath($repository);
 
     if ($path === 'objects/batch') {
       $input = $this->getGitLFSInput();
       $operation = idx($input, 'operation');
       switch ($operation) {
         case 'download':
           return true;
         default:
           return false;
       }
     }
 
     return false;
   }
 
 
 }
diff --git a/src/applications/diffusion/gitlfs/DiffusionGitLFSTemporaryTokenType.php b/src/applications/diffusion/gitlfs/DiffusionGitLFSTemporaryTokenType.php
index 0973072ba4..e5425b07e1 100644
--- a/src/applications/diffusion/gitlfs/DiffusionGitLFSTemporaryTokenType.php
+++ b/src/applications/diffusion/gitlfs/DiffusionGitLFSTemporaryTokenType.php
@@ -1,42 +1,42 @@
 <?php
 
 final class DiffusionGitLFSTemporaryTokenType
   extends PhabricatorAuthTemporaryTokenType {
 
   const TOKENTYPE = 'diffusion.git.lfs';
   const HTTP_USERNAME = '@git-lfs';
 
   public function getTokenTypeDisplayName() {
     return pht('Git Large File Storage');
   }
 
   public function getTokenReadableTypeName(
     PhabricatorAuthTemporaryToken $token) {
     return pht('Git LFS Token');
   }
 
   public static function newHTTPAuthorization(
     PhabricatorRepository $repository,
     PhabricatorUser $viewer,
     $operation) {
 
     $lfs_user = self::HTTP_USERNAME;
     $lfs_pass = Filesystem::readRandomCharacters(32);
-    $lfs_hash = PhabricatorHash::digest($lfs_pass);
+    $lfs_hash = PhabricatorHash::weakDigest($lfs_pass);
 
     $ttl = PhabricatorTime::getNow() + phutil_units('1 day in seconds');
 
     $token = id(new PhabricatorAuthTemporaryToken())
       ->setTokenResource($repository->getPHID())
       ->setTokenType(self::TOKENTYPE)
       ->setTokenCode($lfs_hash)
       ->setUserPHID($viewer->getPHID())
       ->setTemporaryTokenProperty('lfs.operation', $operation)
       ->setTokenExpires($ttl)
       ->save();
 
     $authorization_header = base64_encode($lfs_user.':'.$lfs_pass);
     return 'Basic '.$authorization_header;
   }
 
 }
diff --git a/src/applications/files/engine/PhabricatorChunkedFileStorageEngine.php b/src/applications/files/engine/PhabricatorChunkedFileStorageEngine.php
index 0bbeeeac6c..1bb86cf67e 100644
--- a/src/applications/files/engine/PhabricatorChunkedFileStorageEngine.php
+++ b/src/applications/files/engine/PhabricatorChunkedFileStorageEngine.php
@@ -1,197 +1,197 @@
 <?php
 
 final class PhabricatorChunkedFileStorageEngine
   extends PhabricatorFileStorageEngine {
 
   public function getEngineIdentifier() {
     return 'chunks';
   }
 
   public function getEnginePriority() {
     return 60000;
   }
 
   /**
    * We can write chunks if we have at least one valid storage engine
    * underneath us.
    */
   public function canWriteFiles() {
     return (bool)$this->getWritableEngine();
   }
 
   public function hasFilesizeLimit() {
     return false;
   }
 
   public function isChunkEngine() {
     return true;
   }
 
   public function writeFile($data, array $params) {
     // The chunk engine does not support direct writes.
     throw new PhutilMethodNotImplementedException();
   }
 
   public function readFile($handle) {
     // This is inefficient, but makes the API work as expected.
     $chunks = $this->loadAllChunks($handle, true);
 
     $buffer = '';
     foreach ($chunks as $chunk) {
       $data_file = $chunk->getDataFile();
       if (!$data_file) {
         throw new Exception(pht('This file data is incomplete!'));
       }
 
       $buffer .= $chunk->getDataFile()->loadFileData();
     }
 
     return $buffer;
   }
 
   public function deleteFile($handle) {
     $engine = new PhabricatorDestructionEngine();
     $chunks = $this->loadAllChunks($handle, true);
     foreach ($chunks as $chunk) {
       $engine->destroyObject($chunk);
     }
   }
 
   private function loadAllChunks($handle, $need_files) {
     $chunks = id(new PhabricatorFileChunkQuery())
       ->setViewer(PhabricatorUser::getOmnipotentUser())
       ->withChunkHandles(array($handle))
       ->needDataFiles($need_files)
       ->execute();
 
     $chunks = msort($chunks, 'getByteStart');
 
     return $chunks;
   }
 
   /**
    * Compute a chunked file hash for the viewer.
    *
    * We can not currently compute a real hash for chunked file uploads (because
    * no process sees all of the file data).
    *
    * We also can not trust the hash that the user claims to have computed. If
    * we trust the user, they can upload some `evil.exe` and claim it has the
    * same file hash as `good.exe`. When another user later uploads the real
    * `good.exe`, we'll just create a reference to the existing `evil.exe`. Users
    * who download `good.exe` will then receive `evil.exe`.
    *
    * Instead, we rehash the user's claimed hash with account secrets. This
    * allows users to resume file uploads, but not collide with other users.
    *
    * Ideally, we'd like to be able to verify hashes, but this is complicated
    * and time consuming and gives us a fairly small benefit.
    *
    * @param PhabricatorUser Viewing user.
    * @param string Claimed file hash.
    * @return string Rehashed file hash.
    */
   public static function getChunkedHash(PhabricatorUser $viewer, $hash) {
     if (!$viewer->getPHID()) {
       throw new Exception(
         pht('Unable to compute chunked hash without real viewer!'));
     }
 
     $input = $viewer->getAccountSecret().':'.$hash.':'.$viewer->getPHID();
     return self::getChunkedHashForInput($input);
   }
 
   public static function getChunkedHashForInput($input) {
-    $rehash = PhabricatorHash::digest($input);
+    $rehash = PhabricatorHash::weakDigest($input);
 
     // Add a suffix to identify this as a chunk hash.
     $rehash = substr($rehash, 0, -2).'-C';
 
     return $rehash;
   }
 
   public function allocateChunks($length, array $properties) {
     $file = PhabricatorFile::newChunkedFile($this, $length, $properties);
 
     $chunk_size = $this->getChunkSize();
 
     $handle = $file->getStorageHandle();
 
     $chunks = array();
     for ($ii = 0; $ii < $length; $ii += $chunk_size) {
       $chunks[] = PhabricatorFileChunk::initializeNewChunk(
         $handle,
         $ii,
         min($ii + $chunk_size, $length));
     }
 
     $file->openTransaction();
       foreach ($chunks as $chunk) {
         $chunk->save();
       }
       $file->save();
     $file->saveTransaction();
 
     return $file;
   }
 
   /**
    * Find a storage engine which is suitable for storing chunks.
    *
    * This engine must be a writable engine, have a filesize limit larger than
    * the chunk limit, and must not be a chunk engine itself.
    */
   private function getWritableEngine() {
     // NOTE: We can't just load writable engines or we'll loop forever.
     $engines = parent::loadAllEngines();
 
     foreach ($engines as $engine) {
       if ($engine->isChunkEngine()) {
         continue;
       }
 
       if ($engine->isTestEngine()) {
         continue;
       }
 
       if (!$engine->canWriteFiles()) {
         continue;
       }
 
       if ($engine->hasFilesizeLimit()) {
         if ($engine->getFilesizeLimit() < $this->getChunkSize()) {
           continue;
         }
       }
 
       return true;
     }
 
     return false;
   }
 
   public function getChunkSize() {
     return (4 * 1024 * 1024);
   }
 
   public function getRawFileDataIterator(
     PhabricatorFile $file,
     $begin,
     $end,
     PhabricatorFileStorageFormat $format) {
 
     // NOTE: It is currently impossible for files stored with the chunk
     // engine to have their own formatting (instead, the individual chunks
     // are formatted), so we ignore the format object.
 
     $chunks = id(new PhabricatorFileChunkQuery())
       ->setViewer(PhabricatorUser::getOmnipotentUser())
       ->withChunkHandles(array($file->getStorageHandle()))
       ->withByteRange($begin, $end)
       ->needDataFiles(true)
       ->execute();
 
     return new PhabricatorFileChunkIterator($chunks, $begin, $end);
   }
 
 }
diff --git a/src/applications/metamta/receiver/PhabricatorObjectMailReceiver.php b/src/applications/metamta/receiver/PhabricatorObjectMailReceiver.php
index 52a9a78a19..5985458ab4 100644
--- a/src/applications/metamta/receiver/PhabricatorObjectMailReceiver.php
+++ b/src/applications/metamta/receiver/PhabricatorObjectMailReceiver.php
@@ -1,208 +1,208 @@
 <?php
 
 abstract class PhabricatorObjectMailReceiver extends PhabricatorMailReceiver {
 
   /**
    * Return a regular expression fragment which matches the name of an
    * object which can receive mail. For example, Differential uses:
    *
    *  D[1-9]\d*
    *
    * ...to match `D123`, etc., identifying Differential Revisions.
    *
    * @return string Regular expression fragment.
    */
   abstract protected function getObjectPattern();
 
 
   /**
    * Load the object receiving mail, based on an identifying pattern. Normally
    * this pattern is some sort of object ID.
    *
    * @param   string          A string matched by @{method:getObjectPattern}
    *                          fragment.
    * @param   PhabricatorUser The viewing user.
    * @return  void
    */
   abstract protected function loadObject($pattern, PhabricatorUser $viewer);
 
 
   final protected function processReceivedMail(
     PhabricatorMetaMTAReceivedMail $mail,
     PhabricatorUser $sender) {
 
     $object = $this->loadObjectFromMail($mail, $sender);
     $mail->setRelatedPHID($object->getPHID());
 
     $this->processReceivedObjectMail($mail, $object, $sender);
 
     return $this;
   }
 
   protected function processReceivedObjectMail(
     PhabricatorMetaMTAReceivedMail $mail,
     PhabricatorLiskDAO $object,
     PhabricatorUser $sender) {
 
     $handler = $this->getTransactionReplyHandler();
     if ($handler) {
       return $handler
         ->setMailReceiver($object)
         ->setActor($sender)
         ->setExcludeMailRecipientPHIDs($mail->loadAllRecipientPHIDs())
         ->processEmail($mail);
     }
 
     throw new PhutilMethodNotImplementedException();
   }
 
   protected function getTransactionReplyHandler() {
     return null;
   }
 
   public function loadMailReceiverObject($pattern, PhabricatorUser $viewer) {
     return $this->loadObject($pattern, $viewer);
   }
 
   public function validateSender(
     PhabricatorMetaMTAReceivedMail $mail,
     PhabricatorUser $sender) {
 
     parent::validateSender($mail, $sender);
 
     $parts = $this->matchObjectAddressInMail($mail);
     $pattern = $parts['pattern'];
 
     try {
       $object = $this->loadObjectFromMail($mail, $sender);
     } catch (PhabricatorPolicyException $policy_exception) {
       throw new PhabricatorMetaMTAReceivedMailProcessingException(
         MetaMTAReceivedMailStatus::STATUS_POLICY_PROBLEM,
         pht(
           'This mail is addressed to an object ("%s") you do not have '.
           'permission to see: %s',
           $pattern,
           $policy_exception->getMessage()));
     }
 
     if (!$object) {
       throw new PhabricatorMetaMTAReceivedMailProcessingException(
         MetaMTAReceivedMailStatus::STATUS_NO_SUCH_OBJECT,
         pht(
           'This mail is addressed to an object ("%s"), but that object '.
           'does not exist.',
           $pattern));
     }
 
     $sender_identifier = $parts['sender'];
 
     if ($sender_identifier === 'public') {
       if (!PhabricatorEnv::getEnvConfig('metamta.public-replies')) {
         throw new PhabricatorMetaMTAReceivedMailProcessingException(
           MetaMTAReceivedMailStatus::STATUS_NO_PUBLIC_MAIL,
           pht(
             'This mail is addressed to the public email address of an object '.
             '("%s"), but public replies are not enabled on this Phabricator '.
             'install. An administrator may have recently disabled this '.
             'setting, or you may have replied to an old message. Try '.
             'replying to a more recent message instead.',
             $pattern));
       }
       $check_phid = $object->getPHID();
     } else {
       if ($sender_identifier != $sender->getID()) {
         throw new PhabricatorMetaMTAReceivedMailProcessingException(
           MetaMTAReceivedMailStatus::STATUS_USER_MISMATCH,
           pht(
             'This mail is addressed to the private email address of an object '.
             '("%s"), but you are not the user who is authorized to use the '.
             'address you sent mail to. Each private address is unique to the '.
             'user who received the original mail. Try replying to a message '.
             'which was sent directly to you instead.',
             $pattern));
       }
       $check_phid = $sender->getPHID();
     }
 
     $expect_hash = self::computeMailHash($object->getMailKey(), $check_phid);
 
     if (!phutil_hashes_are_identical($expect_hash, $parts['hash'])) {
       throw new PhabricatorMetaMTAReceivedMailProcessingException(
         MetaMTAReceivedMailStatus::STATUS_HASH_MISMATCH,
         pht(
           'This mail is addressed to an object ("%s"), but the address is '.
           'not correct (the security hash is wrong). Check that the address '.
           'is correct.',
           $pattern));
     }
   }
 
 
   final public function canAcceptMail(PhabricatorMetaMTAReceivedMail $mail) {
     if ($this->matchObjectAddressInMail($mail)) {
       return true;
     }
 
     return false;
   }
 
   private function matchObjectAddressInMail(
     PhabricatorMetaMTAReceivedMail $mail) {
 
     foreach ($mail->getToAddresses() as $address) {
       $parts = $this->matchObjectAddress($address);
       if ($parts) {
         return $parts;
       }
     }
 
     return null;
   }
 
   private function matchObjectAddress($address) {
     $regexp = $this->getAddressRegexp();
 
     $address = self::stripMailboxPrefix($address);
     $local = id(new PhutilEmailAddress($address))->getLocalPart();
 
     $matches = null;
     if (!preg_match($regexp, $local, $matches)) {
       return false;
     }
 
     return $matches;
   }
 
   private function getAddressRegexp() {
     $pattern = $this->getObjectPattern();
 
     $regexp =
       '(^'.
         '(?P<pattern>'.$pattern.')'.
         '\\+'.
         '(?P<sender>\w+)'.
         '\\+'.
         '(?P<hash>[a-f0-9]{16})'.
       '$)Ui';
 
     return $regexp;
   }
 
   private function loadObjectFromMail(
     PhabricatorMetaMTAReceivedMail $mail,
     PhabricatorUser $sender) {
     $parts = $this->matchObjectAddressInMail($mail);
 
     return $this->loadObject(
       phutil_utf8_strtoupper($parts['pattern']),
       $sender);
   }
 
   public static function computeMailHash($mail_key, $phid) {
     $global_mail_key = PhabricatorEnv::getEnvConfig('phabricator.mail-key');
 
-    $hash = PhabricatorHash::digest($mail_key.$global_mail_key.$phid);
+    $hash = PhabricatorHash::weakDigest($mail_key.$global_mail_key.$phid);
     return substr($hash, 0, 16);
   }
 
 }
diff --git a/src/applications/people/storage/PhabricatorUser.php b/src/applications/people/storage/PhabricatorUser.php
index 7edbcd4e52..4a35d9956c 100644
--- a/src/applications/people/storage/PhabricatorUser.php
+++ b/src/applications/people/storage/PhabricatorUser.php
@@ -1,1610 +1,1610 @@
 <?php
 
 /**
  * @task availability Availability
  * @task image-cache Profile Image Cache
  * @task factors Multi-Factor Authentication
  * @task handles Managing Handles
  * @task settings Settings
  * @task cache User Cache
  */
 final class PhabricatorUser
   extends PhabricatorUserDAO
   implements
     PhutilPerson,
     PhabricatorPolicyInterface,
     PhabricatorCustomFieldInterface,
     PhabricatorDestructibleInterface,
     PhabricatorSSHPublicKeyInterface,
     PhabricatorFlaggableInterface,
     PhabricatorApplicationTransactionInterface,
     PhabricatorFulltextInterface,
     PhabricatorConduitResultInterface {
 
   const SESSION_TABLE = 'phabricator_session';
   const NAMETOKEN_TABLE = 'user_nametoken';
   const MAXIMUM_USERNAME_LENGTH = 64;
 
   protected $userName;
   protected $realName;
   protected $passwordSalt;
   protected $passwordHash;
   protected $profileImagePHID;
   protected $defaultProfileImagePHID;
   protected $defaultProfileImageVersion;
   protected $availabilityCache;
   protected $availabilityCacheTTL;
 
   protected $conduitCertificate;
 
   protected $isSystemAgent = 0;
   protected $isMailingList = 0;
   protected $isAdmin = 0;
   protected $isDisabled = 0;
   protected $isEmailVerified = 0;
   protected $isApproved = 0;
   protected $isEnrolledInMultiFactor = 0;
 
   protected $accountSecret;
 
   private $profile = null;
   private $availability = self::ATTACHABLE;
   private $preferences = null;
   private $omnipotent = false;
   private $customFields = self::ATTACHABLE;
   private $badgePHIDs = self::ATTACHABLE;
 
   private $alternateCSRFString = self::ATTACHABLE;
   private $session = self::ATTACHABLE;
   private $rawCacheData = array();
   private $usableCacheData = array();
 
   private $authorities = array();
   private $handlePool;
   private $csrfSalt;
 
   private $settingCacheKeys = array();
   private $settingCache = array();
   private $allowInlineCacheGeneration;
   private $conduitClusterToken = self::ATTACHABLE;
 
   protected function readField($field) {
     switch ($field) {
       // Make sure these return booleans.
       case 'isAdmin':
         return (bool)$this->isAdmin;
       case 'isDisabled':
         return (bool)$this->isDisabled;
       case 'isSystemAgent':
         return (bool)$this->isSystemAgent;
       case 'isMailingList':
         return (bool)$this->isMailingList;
       case 'isEmailVerified':
         return (bool)$this->isEmailVerified;
       case 'isApproved':
         return (bool)$this->isApproved;
       default:
         return parent::readField($field);
     }
   }
 
 
   /**
    * Is this a live account which has passed required approvals? Returns true
    * if this is an enabled, verified (if required), approved (if required)
    * account, and false otherwise.
    *
    * @return bool True if this is a standard, usable account.
    */
   public function isUserActivated() {
     if (!$this->isLoggedIn()) {
       return false;
     }
 
     if ($this->isOmnipotent()) {
       return true;
     }
 
     if ($this->getIsDisabled()) {
       return false;
     }
 
     if (!$this->getIsApproved()) {
       return false;
     }
 
     if (PhabricatorUserEmail::isEmailVerificationRequired()) {
       if (!$this->getIsEmailVerified()) {
         return false;
       }
     }
 
     return true;
   }
 
 
   /**
    * Is this a user who we can reasonably expect to respond to requests?
    *
    * This is used to provide a grey "disabled/unresponsive" dot cue when
    * rendering handles and tags, so it isn't a surprise if you get ignored
    * when you ask things of users who will not receive notifications or could
    * not respond to them (because they are disabled, unapproved, do not have
    * verified email addresses, etc).
    *
    * @return bool True if this user can receive and respond to requests from
    *   other humans.
    */
   public function isResponsive() {
     if (!$this->isUserActivated()) {
       return false;
     }
 
     if (!$this->getIsEmailVerified()) {
       return false;
     }
 
     return true;
   }
 
 
   public function canEstablishWebSessions() {
     if ($this->getIsMailingList()) {
       return false;
     }
 
     if ($this->getIsSystemAgent()) {
       return false;
     }
 
     return true;
   }
 
   public function canEstablishAPISessions() {
     if ($this->getIsDisabled()) {
       return false;
     }
 
     // Intracluster requests are permitted even if the user is logged out:
     // in particular, public users are allowed to issue intracluster requests
     // when browsing Diffusion.
     if (PhabricatorEnv::isClusterRemoteAddress()) {
       if (!$this->isLoggedIn()) {
         return true;
       }
     }
 
     if (!$this->isUserActivated()) {
       return false;
     }
 
     if ($this->getIsMailingList()) {
       return false;
     }
 
     return true;
   }
 
   public function canEstablishSSHSessions() {
     if (!$this->isUserActivated()) {
       return false;
     }
 
     if ($this->getIsMailingList()) {
       return false;
     }
 
     return true;
   }
 
   /**
    * Returns `true` if this is a standard user who is logged in. Returns `false`
    * for logged out, anonymous, or external users.
    *
    * @return bool `true` if the user is a standard user who is logged in with
    *              a normal session.
    */
   public function getIsStandardUser() {
     $type_user = PhabricatorPeopleUserPHIDType::TYPECONST;
     return $this->getPHID() && (phid_get_type($this->getPHID()) == $type_user);
   }
 
   protected function getConfiguration() {
     return array(
       self::CONFIG_AUX_PHID => true,
       self::CONFIG_COLUMN_SCHEMA => array(
         'userName' => 'sort64',
         'realName' => 'text128',
         'passwordSalt' => 'text32?',
         'passwordHash' => 'text128?',
         'profileImagePHID' => 'phid?',
         'conduitCertificate' => 'text255',
         'isSystemAgent' => 'bool',
         'isMailingList' => 'bool',
         'isDisabled' => 'bool',
         'isAdmin' => 'bool',
         'isEmailVerified' => 'uint32',
         'isApproved' => 'uint32',
         'accountSecret' => 'bytes64',
         'isEnrolledInMultiFactor' => 'bool',
         'availabilityCache' => 'text255?',
         'availabilityCacheTTL' => 'uint32?',
         'defaultProfileImagePHID' => 'phid?',
         'defaultProfileImageVersion' => 'text64?',
       ),
       self::CONFIG_KEY_SCHEMA => array(
         'key_phid' => null,
         'phid' => array(
           'columns' => array('phid'),
           'unique' => true,
         ),
         'userName' => array(
           'columns' => array('userName'),
           'unique' => true,
         ),
         'realName' => array(
           'columns' => array('realName'),
         ),
         'key_approved' => array(
           'columns' => array('isApproved'),
         ),
       ),
       self::CONFIG_NO_MUTATE => array(
         'availabilityCache' => true,
         'availabilityCacheTTL' => true,
       ),
     ) + parent::getConfiguration();
   }
 
   public function generatePHID() {
     return PhabricatorPHID::generateNewPHID(
       PhabricatorPeopleUserPHIDType::TYPECONST);
   }
 
   public function setPassword(PhutilOpaqueEnvelope $envelope) {
     if (!$this->getPHID()) {
       throw new Exception(
         pht(
           'You can not set a password for an unsaved user because their PHID '.
           'is a salt component in the password hash.'));
     }
 
     if (!strlen($envelope->openEnvelope())) {
       $this->setPasswordHash('');
     } else {
       $this->setPasswordSalt(md5(Filesystem::readRandomBytes(32)));
       $hash = $this->hashPassword($envelope);
       $this->setPasswordHash($hash->openEnvelope());
     }
     return $this;
   }
 
   public function getMonogram() {
     return '@'.$this->getUsername();
   }
 
   public function isLoggedIn() {
     return !($this->getPHID() === null);
   }
 
   public function save() {
     if (!$this->getConduitCertificate()) {
       $this->setConduitCertificate($this->generateConduitCertificate());
     }
 
     if (!strlen($this->getAccountSecret())) {
       $this->setAccountSecret(Filesystem::readRandomCharacters(64));
     }
 
     $result = parent::save();
 
     if ($this->profile) {
       $this->profile->save();
     }
 
     $this->updateNameTokens();
 
     PhabricatorSearchWorker::queueDocumentForIndexing($this->getPHID());
 
     return $result;
   }
 
   public function attachSession(PhabricatorAuthSession $session) {
     $this->session = $session;
     return $this;
   }
 
   public function getSession() {
     return $this->assertAttached($this->session);
   }
 
   public function hasSession() {
     return ($this->session !== self::ATTACHABLE);
   }
 
   private function generateConduitCertificate() {
     return Filesystem::readRandomCharacters(255);
   }
 
   public function comparePassword(PhutilOpaqueEnvelope $envelope) {
     if (!strlen($envelope->openEnvelope())) {
       return false;
     }
     if (!strlen($this->getPasswordHash())) {
       return false;
     }
 
     return PhabricatorPasswordHasher::comparePassword(
       $this->getPasswordHashInput($envelope),
       new PhutilOpaqueEnvelope($this->getPasswordHash()));
   }
 
   private function getPasswordHashInput(PhutilOpaqueEnvelope $password) {
     $input =
       $this->getUsername().
       $password->openEnvelope().
       $this->getPHID().
       $this->getPasswordSalt();
 
     return new PhutilOpaqueEnvelope($input);
   }
 
   private function hashPassword(PhutilOpaqueEnvelope $password) {
     $hasher = PhabricatorPasswordHasher::getBestHasher();
 
     $input_envelope = $this->getPasswordHashInput($password);
     return $hasher->getPasswordHashForStorage($input_envelope);
   }
 
   const CSRF_CYCLE_FREQUENCY  = 3600;
   const CSRF_SALT_LENGTH      = 8;
   const CSRF_TOKEN_LENGTH     = 16;
   const CSRF_BREACH_PREFIX    = 'B@';
 
   const EMAIL_CYCLE_FREQUENCY = 86400;
   const EMAIL_TOKEN_LENGTH    = 24;
 
   private function getRawCSRFToken($offset = 0) {
     return $this->generateToken(
       time() + (self::CSRF_CYCLE_FREQUENCY * $offset),
       self::CSRF_CYCLE_FREQUENCY,
       PhabricatorEnv::getEnvConfig('phabricator.csrf-key'),
       self::CSRF_TOKEN_LENGTH);
   }
 
   public function getCSRFToken() {
     if ($this->isOmnipotent()) {
       // We may end up here when called from the daemons. The omnipotent user
       // has no meaningful CSRF token, so just return `null`.
       return null;
     }
 
     if ($this->csrfSalt === null) {
       $this->csrfSalt = Filesystem::readRandomCharacters(
         self::CSRF_SALT_LENGTH);
     }
 
     $salt = $this->csrfSalt;
 
     // Generate a token hash to mitigate BREACH attacks against SSL. See
     // discussion in T3684.
     $token = $this->getRawCSRFToken();
-    $hash = PhabricatorHash::digest($token, $salt);
+    $hash = PhabricatorHash::weakDigest($token, $salt);
     return self::CSRF_BREACH_PREFIX.$salt.substr(
         $hash, 0, self::CSRF_TOKEN_LENGTH);
   }
 
   public function validateCSRFToken($token) {
     // We expect a BREACH-mitigating token. See T3684.
     $breach_prefix = self::CSRF_BREACH_PREFIX;
     $breach_prelen = strlen($breach_prefix);
     if (strncmp($token, $breach_prefix, $breach_prelen) !== 0) {
       return false;
     }
 
     $salt = substr($token, $breach_prelen, self::CSRF_SALT_LENGTH);
     $token = substr($token, $breach_prelen + self::CSRF_SALT_LENGTH);
 
     // When the user posts a form, we check that it contains a valid CSRF token.
     // Tokens cycle each hour (every CSRF_CYLCE_FREQUENCY seconds) and we accept
     // either the current token, the next token (users can submit a "future"
     // token if you have two web frontends that have some clock skew) or any of
     // the last 6 tokens. This means that pages are valid for up to 7 hours.
     // There is also some Javascript which periodically refreshes the CSRF
     // tokens on each page, so theoretically pages should be valid indefinitely.
     // However, this code may fail to run (if the user loses their internet
     // connection, or there's a JS problem, or they don't have JS enabled).
     // Choosing the size of the window in which we accept old CSRF tokens is
     // an issue of balancing concerns between security and usability. We could
     // choose a very narrow (e.g., 1-hour) window to reduce vulnerability to
     // attacks using captured CSRF tokens, but it's also more likely that real
     // users will be affected by this, e.g. if they close their laptop for an
     // hour, open it back up, and try to submit a form before the CSRF refresh
     // can kick in. Since the user experience of submitting a form with expired
     // CSRF is often quite bad (you basically lose data, or it's a big pain to
     // recover at least) and I believe we gain little additional protection
     // by keeping the window very short (the overwhelming value here is in
     // preventing blind attacks, and most attacks which can capture CSRF tokens
     // can also just capture authentication information [sniffing networks]
     // or act as the user [xss]) the 7 hour default seems like a reasonable
     // balance. Other major platforms have much longer CSRF token lifetimes,
     // like Rails (session duration) and Django (forever), which suggests this
     // is a reasonable analysis.
     $csrf_window = 6;
 
     for ($ii = -$csrf_window; $ii <= 1; $ii++) {
       $valid = $this->getRawCSRFToken($ii);
 
-      $digest = PhabricatorHash::digest($valid, $salt);
+      $digest = PhabricatorHash::weakDigest($valid, $salt);
       $digest = substr($digest, 0, self::CSRF_TOKEN_LENGTH);
       if (phutil_hashes_are_identical($digest, $token)) {
         return true;
       }
     }
 
     return false;
   }
 
   private function generateToken($epoch, $frequency, $key, $len) {
     if ($this->getPHID()) {
       $vec = $this->getPHID().$this->getAccountSecret();
     } else {
       $vec = $this->getAlternateCSRFString();
     }
 
     if ($this->hasSession()) {
       $vec = $vec.$this->getSession()->getSessionKey();
     }
 
     $time_block = floor($epoch / $frequency);
     $vec = $vec.$key.$time_block;
 
-    return substr(PhabricatorHash::digest($vec), 0, $len);
+    return substr(PhabricatorHash::weakDigest($vec), 0, $len);
   }
 
   public function getUserProfile() {
     return $this->assertAttached($this->profile);
   }
 
   public function attachUserProfile(PhabricatorUserProfile $profile) {
     $this->profile = $profile;
     return $this;
   }
 
   public function loadUserProfile() {
     if ($this->profile) {
       return $this->profile;
     }
 
     $profile_dao = new PhabricatorUserProfile();
     $this->profile = $profile_dao->loadOneWhere('userPHID = %s',
       $this->getPHID());
 
     if (!$this->profile) {
       $this->profile = PhabricatorUserProfile::initializeNewProfile($this);
     }
 
     return $this->profile;
   }
 
   public function loadPrimaryEmailAddress() {
     $email = $this->loadPrimaryEmail();
     if (!$email) {
       throw new Exception(pht('User has no primary email address!'));
     }
     return $email->getAddress();
   }
 
   public function loadPrimaryEmail() {
     return $this->loadOneRelative(
       new PhabricatorUserEmail(),
       'userPHID',
       'getPHID',
       '(isPrimary = 1)');
   }
 
 
 /* -(  Settings  )----------------------------------------------------------- */
 
 
   public function getUserSetting($key) {
     // NOTE: We store available keys and cached values separately to make it
     // faster to check for `null` in the cache, which is common.
     if (isset($this->settingCacheKeys[$key])) {
       return $this->settingCache[$key];
     }
 
     $settings_key = PhabricatorUserPreferencesCacheType::KEY_PREFERENCES;
     if ($this->getPHID()) {
       $settings = $this->requireCacheData($settings_key);
     } else {
       $settings = $this->loadGlobalSettings();
     }
 
     if (array_key_exists($key, $settings)) {
       $value = $settings[$key];
       return $this->writeUserSettingCache($key, $value);
     }
 
     $cache = PhabricatorCaches::getRuntimeCache();
     $cache_key = "settings.defaults({$key})";
     $cache_map = $cache->getKeys(array($cache_key));
 
     if ($cache_map) {
       $value = $cache_map[$cache_key];
     } else {
       $defaults = PhabricatorSetting::getAllSettings();
       if (isset($defaults[$key])) {
         $value = id(clone $defaults[$key])
           ->setViewer($this)
           ->getSettingDefaultValue();
       } else {
         $value = null;
       }
 
       $cache->setKey($cache_key, $value);
     }
 
     return $this->writeUserSettingCache($key, $value);
   }
 
 
   /**
    * Test if a given setting is set to a particular value.
    *
    * @param const Setting key.
    * @param wild Value to compare.
    * @return bool True if the setting has the specified value.
    * @task settings
    */
   public function compareUserSetting($key, $value) {
     $actual = $this->getUserSetting($key);
     return ($actual == $value);
   }
 
   private function writeUserSettingCache($key, $value) {
     $this->settingCacheKeys[$key] = true;
     $this->settingCache[$key] = $value;
     return $value;
   }
 
   public function getTranslation() {
     return $this->getUserSetting(PhabricatorTranslationSetting::SETTINGKEY);
   }
 
   public function getTimezoneIdentifier() {
     return $this->getUserSetting(PhabricatorTimezoneSetting::SETTINGKEY);
   }
 
   public static function getGlobalSettingsCacheKey() {
     return 'user.settings.globals.v1';
   }
 
   private function loadGlobalSettings() {
     $cache_key = self::getGlobalSettingsCacheKey();
     $cache = PhabricatorCaches::getMutableStructureCache();
 
     $settings = $cache->getKey($cache_key);
     if (!$settings) {
       $preferences = PhabricatorUserPreferences::loadGlobalPreferences($this);
       $settings = $preferences->getPreferences();
       $cache->setKey($cache_key, $settings);
     }
 
     return $settings;
   }
 
 
   /**
    * Override the user's timezone identifier.
    *
    * This is primarily useful for unit tests.
    *
    * @param string New timezone identifier.
    * @return this
    * @task settings
    */
   public function overrideTimezoneIdentifier($identifier) {
     $timezone_key = PhabricatorTimezoneSetting::SETTINGKEY;
     $this->settingCacheKeys[$timezone_key] = true;
     $this->settingCache[$timezone_key] = $identifier;
     return $this;
   }
 
   public function getGender() {
     return $this->getUserSetting(PhabricatorPronounSetting::SETTINGKEY);
   }
 
   public function loadEditorLink(
     $path,
     $line,
     PhabricatorRepository $repository = null) {
 
     $editor = $this->getUserSetting(PhabricatorEditorSetting::SETTINGKEY);
 
     if (is_array($path)) {
       $multi_key = PhabricatorEditorMultipleSetting::SETTINGKEY;
       $multiedit = $this->getUserSetting($multi_key);
       switch ($multiedit) {
         case PhabricatorEditorMultipleSetting::VALUE_SPACES:
           $path = implode(' ', $path);
           break;
         case PhabricatorEditorMultipleSetting::VALUE_SINGLE:
         default:
           return null;
       }
     }
 
     if (!strlen($editor)) {
       return null;
     }
 
     if ($repository) {
       $callsign = $repository->getCallsign();
     } else {
       $callsign = null;
     }
 
     $uri = strtr($editor, array(
       '%%' => '%',
       '%f' => phutil_escape_uri($path),
       '%l' => phutil_escape_uri($line),
       '%r' => phutil_escape_uri($callsign),
     ));
 
     // The resulting URI must have an allowed protocol. Otherwise, we'll return
     // a link to an error page explaining the misconfiguration.
 
     $ok = PhabricatorHelpEditorProtocolController::hasAllowedProtocol($uri);
     if (!$ok) {
       return '/help/editorprotocol/';
     }
 
     return (string)$uri;
   }
 
   public function getAlternateCSRFString() {
     return $this->assertAttached($this->alternateCSRFString);
   }
 
   public function attachAlternateCSRFString($string) {
     $this->alternateCSRFString = $string;
     return $this;
   }
 
   /**
    * Populate the nametoken table, which used to fetch typeahead results. When
    * a user types "linc", we want to match "Abraham Lincoln" from on-demand
    * typeahead sources. To do this, we need a separate table of name fragments.
    */
   public function updateNameTokens() {
     $table  = self::NAMETOKEN_TABLE;
     $conn_w = $this->establishConnection('w');
 
     $tokens = PhabricatorTypeaheadDatasource::tokenizeString(
       $this->getUserName().' '.$this->getRealName());
 
     $sql = array();
     foreach ($tokens as $token) {
       $sql[] = qsprintf(
         $conn_w,
         '(%d, %s)',
         $this->getID(),
         $token);
     }
 
     queryfx(
       $conn_w,
       'DELETE FROM %T WHERE userID = %d',
       $table,
       $this->getID());
     if ($sql) {
       queryfx(
         $conn_w,
         'INSERT INTO %T (userID, token) VALUES %Q',
         $table,
         implode(', ', $sql));
     }
   }
 
   public function sendWelcomeEmail(PhabricatorUser $admin) {
     if (!$this->canEstablishWebSessions()) {
       throw new Exception(
         pht(
           'Can not send welcome mail to users who can not establish '.
           'web sessions!'));
     }
 
     $admin_username = $admin->getUserName();
     $admin_realname = $admin->getRealName();
     $user_username = $this->getUserName();
     $is_serious = PhabricatorEnv::getEnvConfig('phabricator.serious-business');
 
     $base_uri = PhabricatorEnv::getProductionURI('/');
 
     $engine = new PhabricatorAuthSessionEngine();
     $uri = $engine->getOneTimeLoginURI(
       $this,
       $this->loadPrimaryEmail(),
       PhabricatorAuthSessionEngine::ONETIME_WELCOME);
 
     $body = pht(
       "Welcome to Phabricator!\n\n".
       "%s (%s) has created an account for you.\n\n".
       "  Username: %s\n\n".
       "To login to Phabricator, follow this link and set a password:\n\n".
       "  %s\n\n".
       "After you have set a password, you can login in the future by ".
       "going here:\n\n".
       "  %s\n",
       $admin_username,
       $admin_realname,
       $user_username,
       $uri,
       $base_uri);
 
     if (!$is_serious) {
       $body .= sprintf(
         "\n%s\n",
         pht("Love,\nPhabricator"));
     }
 
     $mail = id(new PhabricatorMetaMTAMail())
       ->addTos(array($this->getPHID()))
       ->setForceDelivery(true)
       ->setSubject(pht('[Phabricator] Welcome to Phabricator'))
       ->setBody($body)
       ->saveAndSend();
   }
 
   public function sendUsernameChangeEmail(
     PhabricatorUser $admin,
     $old_username) {
 
     $admin_username = $admin->getUserName();
     $admin_realname = $admin->getRealName();
     $new_username = $this->getUserName();
 
     $password_instructions = null;
     if (PhabricatorPasswordAuthProvider::getPasswordProvider()) {
       $engine = new PhabricatorAuthSessionEngine();
       $uri = $engine->getOneTimeLoginURI(
         $this,
         null,
         PhabricatorAuthSessionEngine::ONETIME_USERNAME);
       $password_instructions = sprintf(
         "%s\n\n  %s\n\n%s\n",
         pht(
           "If you use a password to login, you'll need to reset it ".
           "before you can login again. You can reset your password by ".
           "following this link:"),
         $uri,
         pht(
           "And, of course, you'll need to use your new username to login ".
           "from now on. If you use OAuth to login, nothing should change."));
     }
 
     $body = sprintf(
       "%s\n\n  %s\n  %s\n\n%s",
       pht(
         '%s (%s) has changed your Phabricator username.',
         $admin_username,
         $admin_realname),
       pht(
         'Old Username: %s',
         $old_username),
       pht(
         'New Username: %s',
         $new_username),
       $password_instructions);
 
     $mail = id(new PhabricatorMetaMTAMail())
       ->addTos(array($this->getPHID()))
       ->setForceDelivery(true)
       ->setSubject(pht('[Phabricator] Username Changed'))
       ->setBody($body)
       ->saveAndSend();
   }
 
   public static function describeValidUsername() {
     return pht(
       'Usernames must contain only numbers, letters, period, underscore and '.
       'hyphen, and can not end with a period. They must have no more than %d '.
       'characters.',
       new PhutilNumber(self::MAXIMUM_USERNAME_LENGTH));
   }
 
   public static function validateUsername($username) {
     // NOTE: If you update this, make sure to update:
     //
     //  - Remarkup rule for @mentions.
     //  - Routing rule for "/p/username/".
     //  - Unit tests, obviously.
     //  - describeValidUsername() method, above.
 
     if (strlen($username) > self::MAXIMUM_USERNAME_LENGTH) {
       return false;
     }
 
     return (bool)preg_match('/^[a-zA-Z0-9._-]*[a-zA-Z0-9_-]\z/', $username);
   }
 
   public static function getDefaultProfileImageURI() {
     return celerity_get_resource_uri('/rsrc/image/avatar.png');
   }
 
   public function getProfileImageURI() {
     $uri_key = PhabricatorUserProfileImageCacheType::KEY_URI;
     return $this->requireCacheData($uri_key);
   }
 
   public function getUnreadNotificationCount() {
     $notification_key = PhabricatorUserNotificationCountCacheType::KEY_COUNT;
     return $this->requireCacheData($notification_key);
   }
 
   public function getUnreadMessageCount() {
     $message_key = PhabricatorUserMessageCountCacheType::KEY_COUNT;
     return $this->requireCacheData($message_key);
   }
 
   public function getRecentBadgeAwards() {
     $badges_key = PhabricatorUserBadgesCacheType::KEY_BADGES;
     return $this->requireCacheData($badges_key);
   }
 
   public function getFullName() {
     if (strlen($this->getRealName())) {
       return $this->getUsername().' ('.$this->getRealName().')';
     } else {
       return $this->getUsername();
     }
   }
 
   public function getTimeZone() {
     return new DateTimeZone($this->getTimezoneIdentifier());
   }
 
   public function getTimeZoneOffset() {
     $timezone = $this->getTimeZone();
     $now = new DateTime('@'.PhabricatorTime::getNow());
     $offset = $timezone->getOffset($now);
 
     // Javascript offsets are in minutes and have the opposite sign.
     $offset = -(int)($offset / 60);
 
     return $offset;
   }
 
   public function getTimeZoneOffsetInHours() {
     $offset = $this->getTimeZoneOffset();
     $offset = (int)round($offset / 60);
     $offset = -$offset;
 
     return $offset;
   }
 
   public function formatShortDateTime($when, $now = null) {
     if ($now === null) {
       $now = PhabricatorTime::getNow();
     }
 
     try {
       $when = new DateTime('@'.$when);
       $now = new DateTime('@'.$now);
     } catch (Exception $ex) {
       return null;
     }
 
     $zone = $this->getTimeZone();
 
     $when->setTimeZone($zone);
     $now->setTimeZone($zone);
 
     if ($when->format('Y') !== $now->format('Y')) {
       // Different year, so show "Feb 31 2075".
       $format = 'M j Y';
     } else if ($when->format('Ymd') !== $now->format('Ymd')) {
       // Same year but different month and day, so show "Feb 31".
       $format = 'M j';
     } else {
       // Same year, month and day so show a time of day.
       $pref_time = PhabricatorTimeFormatSetting::SETTINGKEY;
       $format = $this->getUserSetting($pref_time);
     }
 
     return $when->format($format);
   }
 
   public function __toString() {
     return $this->getUsername();
   }
 
   public static function loadOneWithEmailAddress($address) {
     $email = id(new PhabricatorUserEmail())->loadOneWhere(
       'address = %s',
       $address);
     if (!$email) {
       return null;
     }
     return id(new PhabricatorUser())->loadOneWhere(
       'phid = %s',
       $email->getUserPHID());
   }
 
   public function getDefaultSpacePHID() {
     // TODO: We might let the user switch which space they're "in" later on;
     // for now just use the global space if one exists.
 
     // If the viewer has access to the default space, use that.
     $spaces = PhabricatorSpacesNamespaceQuery::getViewerActiveSpaces($this);
     foreach ($spaces as $space) {
       if ($space->getIsDefaultNamespace()) {
         return $space->getPHID();
       }
     }
 
     // Otherwise, use the space with the lowest ID that they have access to.
     // This just tends to keep the default stable and predictable over time,
     // so adding a new space won't change behavior for users.
     if ($spaces) {
       $spaces = msort($spaces, 'getID');
       return head($spaces)->getPHID();
     }
 
     return null;
   }
 
 
   /**
    * Grant a user a source of authority, to let them bypass policy checks they
    * could not otherwise.
    */
   public function grantAuthority($authority) {
     $this->authorities[] = $authority;
     return $this;
   }
 
 
   /**
    * Get authorities granted to the user.
    */
   public function getAuthorities() {
     return $this->authorities;
   }
 
   public function hasConduitClusterToken() {
     return ($this->conduitClusterToken !== self::ATTACHABLE);
   }
 
   public function attachConduitClusterToken(PhabricatorConduitToken $token) {
     $this->conduitClusterToken = $token;
     return $this;
   }
 
   public function getConduitClusterToken() {
     return $this->assertAttached($this->conduitClusterToken);
   }
 
 
 /* -(  Availability  )------------------------------------------------------- */
 
 
   /**
    * @task availability
    */
   public function attachAvailability(array $availability) {
     $this->availability = $availability;
     return $this;
   }
 
 
   /**
    * Get the timestamp the user is away until, if they are currently away.
    *
    * @return int|null Epoch timestamp, or `null` if the user is not away.
    * @task availability
    */
   public function getAwayUntil() {
     $availability = $this->availability;
 
     $this->assertAttached($availability);
     if (!$availability) {
       return null;
     }
 
     return idx($availability, 'until');
   }
 
 
   public function getDisplayAvailability() {
     $availability = $this->availability;
 
     $this->assertAttached($availability);
     if (!$availability) {
       return null;
     }
 
     $busy = PhabricatorCalendarEventInvitee::AVAILABILITY_BUSY;
 
     return idx($availability, 'availability', $busy);
   }
 
 
   public function getAvailabilityEventPHID() {
     $availability = $this->availability;
 
     $this->assertAttached($availability);
     if (!$availability) {
       return null;
     }
 
     return idx($availability, 'eventPHID');
   }
 
 
   /**
    * Get cached availability, if present.
    *
    * @return wild|null Cache data, or null if no cache is available.
    * @task availability
    */
   public function getAvailabilityCache() {
     $now = PhabricatorTime::getNow();
     if ($this->availabilityCacheTTL <= $now) {
       return null;
     }
 
     try {
       return phutil_json_decode($this->availabilityCache);
     } catch (Exception $ex) {
       return null;
     }
   }
 
 
   /**
    * Write to the availability cache.
    *
    * @param wild Availability cache data.
    * @param int|null Cache TTL.
    * @return this
    * @task availability
    */
   public function writeAvailabilityCache(array $availability, $ttl) {
     if (PhabricatorEnv::isReadOnly()) {
       return $this;
     }
 
     $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
     queryfx(
       $this->establishConnection('w'),
       'UPDATE %T SET availabilityCache = %s, availabilityCacheTTL = %nd
         WHERE id = %d',
       $this->getTableName(),
       json_encode($availability),
       $ttl,
       $this->getID());
     unset($unguarded);
 
     return $this;
   }
 
 
 /* -(  Multi-Factor Authentication  )---------------------------------------- */
 
 
   /**
    * Update the flag storing this user's enrollment in multi-factor auth.
    *
    * With certain settings, we need to check if a user has MFA on every page,
    * so we cache MFA enrollment on the user object for performance. Calling this
    * method synchronizes the cache by examining enrollment records. After
    * updating the cache, use @{method:getIsEnrolledInMultiFactor} to check if
    * the user is enrolled.
    *
    * This method should be called after any changes are made to a given user's
    * multi-factor configuration.
    *
    * @return void
    * @task factors
    */
   public function updateMultiFactorEnrollment() {
     $factors = id(new PhabricatorAuthFactorConfig())->loadAllWhere(
       'userPHID = %s',
       $this->getPHID());
 
     $enrolled = count($factors) ? 1 : 0;
     if ($enrolled !== $this->isEnrolledInMultiFactor) {
       $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
         queryfx(
           $this->establishConnection('w'),
           'UPDATE %T SET isEnrolledInMultiFactor = %d WHERE id = %d',
           $this->getTableName(),
           $enrolled,
           $this->getID());
       unset($unguarded);
 
       $this->isEnrolledInMultiFactor = $enrolled;
     }
   }
 
 
   /**
    * Check if the user is enrolled in multi-factor authentication.
    *
    * Enrolled users have one or more multi-factor authentication sources
    * attached to their account. For performance, this value is cached. You
    * can use @{method:updateMultiFactorEnrollment} to update the cache.
    *
    * @return bool True if the user is enrolled.
    * @task factors
    */
   public function getIsEnrolledInMultiFactor() {
     return $this->isEnrolledInMultiFactor;
   }
 
 
 /* -(  Omnipotence  )-------------------------------------------------------- */
 
 
   /**
    * Returns true if this user is omnipotent. Omnipotent users bypass all policy
    * checks.
    *
    * @return bool True if the user bypasses policy checks.
    */
   public function isOmnipotent() {
     return $this->omnipotent;
   }
 
 
   /**
    * Get an omnipotent user object for use in contexts where there is no acting
    * user, notably daemons.
    *
    * @return PhabricatorUser An omnipotent user.
    */
   public static function getOmnipotentUser() {
     static $user = null;
     if (!$user) {
       $user = new PhabricatorUser();
       $user->omnipotent = true;
       $user->makeEphemeral();
     }
     return $user;
   }
 
 
   /**
    * Get a scalar string identifying this user.
    *
    * This is similar to using the PHID, but distinguishes between ominpotent
    * and public users explicitly. This allows safe construction of cache keys
    * or cache buckets which do not conflate public and omnipotent users.
    *
    * @return string Scalar identifier.
    */
   public function getCacheFragment() {
     if ($this->isOmnipotent()) {
       return 'u.omnipotent';
     }
 
     $phid = $this->getPHID();
     if ($phid) {
       return 'u.'.$phid;
     }
 
     return 'u.public';
   }
 
 
 /* -(  Managing Handles  )--------------------------------------------------- */
 
 
   /**
    * Get a @{class:PhabricatorHandleList} which benefits from this viewer's
    * internal handle pool.
    *
    * @param list<phid> List of PHIDs to load.
    * @return PhabricatorHandleList Handle list object.
    * @task handle
    */
   public function loadHandles(array $phids) {
     if ($this->handlePool === null) {
       $this->handlePool = id(new PhabricatorHandlePool())
         ->setViewer($this);
     }
 
     return $this->handlePool->newHandleList($phids);
   }
 
 
   /**
    * Get a @{class:PHUIHandleView} for a single handle.
    *
    * This benefits from the viewer's internal handle pool.
    *
    * @param phid PHID to render a handle for.
    * @return PHUIHandleView View of the handle.
    * @task handle
    */
   public function renderHandle($phid) {
     return $this->loadHandles(array($phid))->renderHandle($phid);
   }
 
 
   /**
    * Get a @{class:PHUIHandleListView} for a list of handles.
    *
    * This benefits from the viewer's internal handle pool.
    *
    * @param list<phid> List of PHIDs to render.
    * @return PHUIHandleListView View of the handles.
    * @task handle
    */
   public function renderHandleList(array $phids) {
     return $this->loadHandles($phids)->renderList();
   }
 
   public function attachBadgePHIDs(array $phids) {
     $this->badgePHIDs = $phids;
     return $this;
   }
 
   public function getBadgePHIDs() {
     return $this->assertAttached($this->badgePHIDs);
   }
 
 
 /* -(  PhabricatorPolicyInterface  )----------------------------------------- */
 
 
   public function getCapabilities() {
     return array(
       PhabricatorPolicyCapability::CAN_VIEW,
       PhabricatorPolicyCapability::CAN_EDIT,
     );
   }
 
   public function getPolicy($capability) {
     switch ($capability) {
       case PhabricatorPolicyCapability::CAN_VIEW:
         return PhabricatorPolicies::POLICY_PUBLIC;
       case PhabricatorPolicyCapability::CAN_EDIT:
         if ($this->getIsSystemAgent() || $this->getIsMailingList()) {
           return PhabricatorPolicies::POLICY_ADMIN;
         } else {
           return PhabricatorPolicies::POLICY_NOONE;
         }
     }
   }
 
   public function hasAutomaticCapability($capability, PhabricatorUser $viewer) {
     return $this->getPHID() && ($viewer->getPHID() === $this->getPHID());
   }
 
   public function describeAutomaticCapability($capability) {
     switch ($capability) {
       case PhabricatorPolicyCapability::CAN_EDIT:
         return pht('Only you can edit your information.');
       default:
         return null;
     }
   }
 
 
 /* -(  PhabricatorCustomFieldInterface  )------------------------------------ */
 
 
   public function getCustomFieldSpecificationForRole($role) {
     return PhabricatorEnv::getEnvConfig('user.fields');
   }
 
   public function getCustomFieldBaseClass() {
     return 'PhabricatorUserCustomField';
   }
 
   public function getCustomFields() {
     return $this->assertAttached($this->customFields);
   }
 
   public function attachCustomFields(PhabricatorCustomFieldAttachment $fields) {
     $this->customFields = $fields;
     return $this;
   }
 
 
 /* -(  PhabricatorDestructibleInterface  )----------------------------------- */
 
 
   public function destroyObjectPermanently(
     PhabricatorDestructionEngine $engine) {
 
     $this->openTransaction();
       $this->delete();
 
       $externals = id(new PhabricatorExternalAccount())->loadAllWhere(
         'userPHID = %s',
         $this->getPHID());
       foreach ($externals as $external) {
         $external->delete();
       }
 
       $prefs = id(new PhabricatorUserPreferencesQuery())
         ->setViewer($engine->getViewer())
         ->withUsers(array($this))
         ->execute();
       foreach ($prefs as $pref) {
         $engine->destroyObject($pref);
       }
 
       $profiles = id(new PhabricatorUserProfile())->loadAllWhere(
         'userPHID = %s',
         $this->getPHID());
       foreach ($profiles as $profile) {
         $profile->delete();
       }
 
       $keys = id(new PhabricatorAuthSSHKeyQuery())
         ->setViewer($engine->getViewer())
         ->withObjectPHIDs(array($this->getPHID()))
         ->execute();
       foreach ($keys as $key) {
         $engine->destroyObject($key);
       }
 
       $emails = id(new PhabricatorUserEmail())->loadAllWhere(
         'userPHID = %s',
         $this->getPHID());
       foreach ($emails as $email) {
         $email->delete();
       }
 
       $sessions = id(new PhabricatorAuthSession())->loadAllWhere(
         'userPHID = %s',
         $this->getPHID());
       foreach ($sessions as $session) {
         $session->delete();
       }
 
       $factors = id(new PhabricatorAuthFactorConfig())->loadAllWhere(
         'userPHID = %s',
         $this->getPHID());
       foreach ($factors as $factor) {
         $factor->delete();
       }
 
     $this->saveTransaction();
   }
 
 
 /* -(  PhabricatorSSHPublicKeyInterface  )----------------------------------- */
 
 
   public function getSSHPublicKeyManagementURI(PhabricatorUser $viewer) {
     if ($viewer->getPHID() == $this->getPHID()) {
       // If the viewer is managing their own keys, take them to the normal
       // panel.
       return '/settings/panel/ssh/';
     } else {
       // Otherwise, take them to the administrative panel for this user.
       return '/settings/'.$this->getID().'/panel/ssh/';
     }
   }
 
   public function getSSHKeyDefaultName() {
     return 'id_rsa_phabricator';
   }
 
   public function getSSHKeyNotifyPHIDs() {
     return array(
       $this->getPHID(),
     );
   }
 
 
 /* -(  PhabricatorApplicationTransactionInterface  )------------------------- */
 
 
   public function getApplicationTransactionEditor() {
     return new PhabricatorUserProfileEditor();
   }
 
   public function getApplicationTransactionObject() {
     return $this;
   }
 
   public function getApplicationTransactionTemplate() {
     return new PhabricatorUserTransaction();
   }
 
   public function willRenderTimeline(
     PhabricatorApplicationTransactionView $timeline,
     AphrontRequest $request) {
     return $timeline;
   }
 
 
 /* -(  PhabricatorFulltextInterface  )--------------------------------------- */
 
 
   public function newFulltextEngine() {
     return new PhabricatorUserFulltextEngine();
   }
 
 
 /* -(  PhabricatorConduitResultInterface  )---------------------------------- */
 
 
   public function getFieldSpecificationsForConduit() {
     return array(
       id(new PhabricatorConduitSearchFieldSpecification())
         ->setKey('username')
         ->setType('string')
         ->setDescription(pht("The user's username.")),
       id(new PhabricatorConduitSearchFieldSpecification())
         ->setKey('realName')
         ->setType('string')
         ->setDescription(pht("The user's real name.")),
       id(new PhabricatorConduitSearchFieldSpecification())
         ->setKey('roles')
         ->setType('list<string>')
         ->setDescription(pht('List of acccount roles.')),
     );
   }
 
   public function getFieldValuesForConduit() {
     $roles = array();
 
     if ($this->getIsDisabled()) {
       $roles[] = 'disabled';
     }
 
     if ($this->getIsSystemAgent()) {
       $roles[] = 'bot';
     }
 
     if ($this->getIsMailingList()) {
       $roles[] = 'list';
     }
 
     if ($this->getIsAdmin()) {
       $roles[] = 'admin';
     }
 
     if ($this->getIsEmailVerified()) {
       $roles[] = 'verified';
     }
 
     if ($this->getIsApproved()) {
       $roles[] = 'approved';
     }
 
     if ($this->isUserActivated()) {
       $roles[] = 'activated';
     }
 
     return array(
       'username' => $this->getUsername(),
       'realName' => $this->getRealName(),
       'roles' => $roles,
     );
   }
 
   public function getConduitSearchAttachments() {
     return array();
   }
 
 
 /* -(  User Cache  )--------------------------------------------------------- */
 
 
   /**
    * @task cache
    */
   public function attachRawCacheData(array $data) {
     $this->rawCacheData = $data + $this->rawCacheData;
     return $this;
   }
 
   public function setAllowInlineCacheGeneration($allow_cache_generation) {
     $this->allowInlineCacheGeneration = $allow_cache_generation;
     return $this;
   }
 
   /**
    * @task cache
    */
   protected function requireCacheData($key) {
     if (isset($this->usableCacheData[$key])) {
       return $this->usableCacheData[$key];
     }
 
     $type = PhabricatorUserCacheType::requireCacheTypeForKey($key);
 
     if (isset($this->rawCacheData[$key])) {
       $raw_value = $this->rawCacheData[$key];
 
       $usable_value = $type->getValueFromStorage($raw_value);
       $this->usableCacheData[$key] = $usable_value;
 
       return $usable_value;
     }
 
     // By default, we throw if a cache isn't available. This is consistent
     // with the standard `needX()` + `attachX()` + `getX()` interaction.
     if (!$this->allowInlineCacheGeneration) {
       throw new PhabricatorDataNotAttachedException($this);
     }
 
     $user_phid = $this->getPHID();
 
     // Try to read the actual cache before we generate a new value. We can
     // end up here via Conduit, which does not use normal sessions and can
     // not pick up a free cache load during session identification.
     if ($user_phid) {
       $raw_data = PhabricatorUserCache::readCaches(
         $type,
         $key,
         array($user_phid));
       if (array_key_exists($user_phid, $raw_data)) {
         $raw_value = $raw_data[$user_phid];
         $usable_value = $type->getValueFromStorage($raw_value);
         $this->rawCacheData[$key] = $raw_value;
         $this->usableCacheData[$key] = $usable_value;
         return $usable_value;
       }
     }
 
     $usable_value = $type->getDefaultValue();
 
     if ($user_phid) {
       $map = $type->newValueForUsers($key, array($this));
       if (array_key_exists($user_phid, $map)) {
         $raw_value = $map[$user_phid];
         $usable_value = $type->getValueFromStorage($raw_value);
 
         $this->rawCacheData[$key] = $raw_value;
         PhabricatorUserCache::writeCache(
           $type,
           $key,
           $user_phid,
           $raw_value);
       }
     }
 
     $this->usableCacheData[$key] = $usable_value;
 
     return $usable_value;
   }
 
 
   /**
    * @task cache
    */
   public function clearCacheData($key) {
     unset($this->rawCacheData[$key]);
     unset($this->usableCacheData[$key]);
     return $this;
   }
 
 
   public function getCSSValue($variable_key) {
     $preference = PhabricatorAccessibilitySetting::SETTINGKEY;
     $key = $this->getUserSetting($preference);
 
     $postprocessor = CelerityPostprocessor::getPostprocessor($key);
     $variables = $postprocessor->getVariables();
 
     if (!isset($variables[$variable_key])) {
       throw new Exception(
         pht(
           'Unknown CSS variable "%s"!',
           $variable_key));
     }
 
     return $variables[$variable_key];
   }
 
 }
diff --git a/src/applications/settings/panel/PhabricatorPasswordSettingsPanel.php b/src/applications/settings/panel/PhabricatorPasswordSettingsPanel.php
index fa91dac210..17b8cdde95 100644
--- a/src/applications/settings/panel/PhabricatorPasswordSettingsPanel.php
+++ b/src/applications/settings/panel/PhabricatorPasswordSettingsPanel.php
@@ -1,217 +1,217 @@
 <?php
 
 final class PhabricatorPasswordSettingsPanel extends PhabricatorSettingsPanel {
 
   public function getPanelKey() {
     return 'password';
   }
 
   public function getPanelName() {
     return pht('Password');
   }
 
   public function getPanelGroupKey() {
     return PhabricatorSettingsAuthenticationPanelGroup::PANELGROUPKEY;
   }
 
   public function isEnabled() {
     // There's no sense in showing a change password panel if this install
     // doesn't support password authentication.
     if (!PhabricatorPasswordAuthProvider::getPasswordProvider()) {
       return false;
     }
 
     return true;
   }
 
   public function processRequest(AphrontRequest $request) {
     $user = $request->getUser();
 
     $token = id(new PhabricatorAuthSessionEngine())->requireHighSecuritySession(
       $user,
       $request,
       '/settings/');
 
     $min_len = PhabricatorEnv::getEnvConfig('account.minimum-password-length');
     $min_len = (int)$min_len;
 
     // NOTE: To change your password, you need to prove you own the account,
     // either by providing the old password or by carrying a token to
     // the workflow from a password reset email.
 
     $key = $request->getStr('key');
     $password_type = PhabricatorAuthPasswordResetTemporaryTokenType::TOKENTYPE;
 
     $token = null;
     if ($key) {
       $token = id(new PhabricatorAuthTemporaryTokenQuery())
         ->setViewer($user)
         ->withTokenResources(array($user->getPHID()))
         ->withTokenTypes(array($password_type))
-        ->withTokenCodes(array(PhabricatorHash::digest($key)))
+        ->withTokenCodes(array(PhabricatorHash::weakDigest($key)))
         ->withExpired(false)
         ->executeOne();
     }
 
     $e_old = true;
     $e_new = true;
     $e_conf = true;
 
     $errors = array();
     if ($request->isFormPost()) {
       if (!$token) {
         $envelope = new PhutilOpaqueEnvelope($request->getStr('old_pw'));
         if (!$user->comparePassword($envelope)) {
           $errors[] = pht('The old password you entered is incorrect.');
           $e_old = pht('Invalid');
         }
       }
 
       $pass = $request->getStr('new_pw');
       $conf = $request->getStr('conf_pw');
 
       if (strlen($pass) < $min_len) {
         $errors[] = pht('Your new password is too short.');
         $e_new = pht('Too Short');
       } else if ($pass !== $conf) {
         $errors[] = pht('New password and confirmation do not match.');
         $e_conf = pht('Invalid');
       } else if (PhabricatorCommonPasswords::isCommonPassword($pass)) {
         $e_new = pht('Very Weak');
         $e_conf = pht('Very Weak');
         $errors[] = pht(
           'Your new password is very weak: it is one of the most common '.
           'passwords in use. Choose a stronger password.');
       }
 
       if (!$errors) {
         // This write is unguarded because the CSRF token has already
         // been checked in the call to $request->isFormPost() and
         // the CSRF token depends on the password hash, so when it
         // is changed here the CSRF token check will fail.
         $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
 
           $envelope = new PhutilOpaqueEnvelope($pass);
           id(new PhabricatorUserEditor())
             ->setActor($user)
             ->changePassword($user, $envelope);
 
         unset($unguarded);
 
         if ($token) {
           // Destroy the token.
           $token->delete();
 
           // If this is a password set/reset, kick the user to the home page
           // after we update their account.
           $next = '/';
         } else {
           $next = $this->getPanelURI('?saved=true');
         }
 
         id(new PhabricatorAuthSessionEngine())->terminateLoginSessions(
           $user,
           $request->getCookie(PhabricatorCookies::COOKIE_SESSION));
 
         return id(new AphrontRedirectResponse())->setURI($next);
       }
     }
 
     $hash_envelope = new PhutilOpaqueEnvelope($user->getPasswordHash());
     if (strlen($hash_envelope->openEnvelope())) {
       try {
         $can_upgrade = PhabricatorPasswordHasher::canUpgradeHash(
           $hash_envelope);
       } catch (PhabricatorPasswordHasherUnavailableException $ex) {
         $can_upgrade = false;
 
         // Only show this stuff if we aren't on the reset workflow. We can
         // do resets regardless of the old hasher's availability.
         if (!$token) {
           $errors[] = pht(
             'Your password is currently hashed using an algorithm which is '.
             'no longer available on this install.');
           $errors[] = pht(
             'Because the algorithm implementation is missing, your password '.
             'can not be used or updated.');
           $errors[] = pht(
             'To set a new password, request a password reset link from the '.
             'login screen and then follow the instructions.');
         }
       }
 
       if ($can_upgrade) {
         $errors[] = pht(
           'The strength of your stored password hash can be upgraded. '.
           'To upgrade, either: log out and log in using your password; or '.
           'change your password.');
       }
     }
 
     $len_caption = null;
     if ($min_len) {
       $len_caption = pht('Minimum password length: %d characters.', $min_len);
     }
 
     $form = new AphrontFormView();
     $form
       ->setUser($user)
       ->addHiddenInput('key', $key);
 
     if (!$token) {
       $form->appendChild(
         id(new AphrontFormPasswordControl())
           ->setLabel(pht('Old Password'))
           ->setError($e_old)
           ->setName('old_pw'));
     }
 
     $form
       ->appendChild(
         id(new AphrontFormPasswordControl())
           ->setDisableAutocomplete(true)
           ->setLabel(pht('New Password'))
           ->setError($e_new)
           ->setName('new_pw'));
     $form
       ->appendChild(
         id(new AphrontFormPasswordControl())
           ->setDisableAutocomplete(true)
           ->setLabel(pht('Confirm Password'))
           ->setCaption($len_caption)
           ->setError($e_conf)
           ->setName('conf_pw'));
     $form
       ->appendChild(
         id(new AphrontFormSubmitControl())
           ->setValue(pht('Change Password')));
 
     $form->appendChild(
       id(new AphrontFormStaticControl())
         ->setLabel(pht('Current Algorithm'))
         ->setValue(PhabricatorPasswordHasher::getCurrentAlgorithmName(
           new PhutilOpaqueEnvelope($user->getPasswordHash()))));
 
     $form->appendChild(
       id(new AphrontFormStaticControl())
         ->setLabel(pht('Best Available Algorithm'))
         ->setValue(PhabricatorPasswordHasher::getBestAlgorithmName()));
 
     $form->appendRemarkupInstructions(
       pht(
         'NOTE: Changing your password will terminate any other outstanding '.
         'login sessions.'));
 
     $form_box = id(new PHUIObjectBoxView())
       ->setHeaderText(pht('Change Password'))
       ->setFormSaved($request->getStr('saved'))
       ->setFormErrors($errors)
       ->setForm($form);
 
     return array(
       $form_box,
     );
   }
 
 
 }
diff --git a/src/applications/settings/panel/PhabricatorSessionsSettingsPanel.php b/src/applications/settings/panel/PhabricatorSessionsSettingsPanel.php
index e3a37c9dfc..a468ed53d0 100644
--- a/src/applications/settings/panel/PhabricatorSessionsSettingsPanel.php
+++ b/src/applications/settings/panel/PhabricatorSessionsSettingsPanel.php
@@ -1,144 +1,144 @@
 <?php
 
 final class PhabricatorSessionsSettingsPanel extends PhabricatorSettingsPanel {
 
   public function getPanelKey() {
     return 'sessions';
   }
 
   public function getPanelName() {
     return pht('Sessions');
   }
 
   public function getPanelGroupKey() {
     return PhabricatorSettingsLogsPanelGroup::PANELGROUPKEY;
   }
 
   public function isEnabled() {
     return true;
   }
 
   public function processRequest(AphrontRequest $request) {
     $viewer = $request->getUser();
 
     $accounts = id(new PhabricatorExternalAccountQuery())
       ->setViewer($viewer)
       ->withUserPHIDs(array($viewer->getPHID()))
       ->requireCapabilities(
         array(
           PhabricatorPolicyCapability::CAN_VIEW,
           PhabricatorPolicyCapability::CAN_EDIT,
         ))
       ->execute();
 
     $identity_phids = mpull($accounts, 'getPHID');
     $identity_phids[] = $viewer->getPHID();
 
     $sessions = id(new PhabricatorAuthSessionQuery())
       ->setViewer($viewer)
       ->withIdentityPHIDs($identity_phids)
       ->execute();
 
     $handles = id(new PhabricatorHandleQuery())
       ->setViewer($viewer)
       ->withPHIDs($identity_phids)
       ->execute();
 
-    $current_key = PhabricatorHash::digest(
+    $current_key = PhabricatorHash::weakDigest(
       $request->getCookie(PhabricatorCookies::COOKIE_SESSION));
 
     $rows = array();
     $rowc = array();
     foreach ($sessions as $session) {
       $is_current = phutil_hashes_are_identical(
         $session->getSessionKey(),
         $current_key);
       if ($is_current) {
         $rowc[] = 'highlighted';
         $button = phutil_tag(
           'a',
           array(
             'class' => 'small grey button disabled',
           ),
           pht('Current'));
       } else {
         $rowc[] = null;
         $button = javelin_tag(
           'a',
           array(
             'href' => '/auth/session/terminate/'.$session->getID().'/',
             'class' => 'small grey button',
             'sigil' => 'workflow',
           ),
           pht('Terminate'));
       }
 
       $hisec = ($session->getHighSecurityUntil() - time());
 
       $rows[] = array(
         $handles[$session->getUserPHID()]->renderLink(),
         substr($session->getSessionKey(), 0, 6),
         $session->getType(),
         ($hisec > 0)
           ? phutil_format_relative_time($hisec)
           : null,
         phabricator_datetime($session->getSessionStart(), $viewer),
         phabricator_date($session->getSessionExpires(), $viewer),
         $button,
       );
     }
 
     $table = new AphrontTableView($rows);
     $table->setNoDataString(pht("You don't have any active sessions."));
     $table->setRowClasses($rowc);
     $table->setHeaders(
       array(
         pht('Identity'),
         pht('Session'),
         pht('Type'),
         pht('HiSec'),
         pht('Created'),
         pht('Expires'),
         pht(''),
       ));
     $table->setColumnClasses(
       array(
         'wide',
         'n',
         '',
         'right',
         'right',
         'right',
         'action',
       ));
 
     $terminate_button = id(new PHUIButtonView())
       ->setText(pht('Terminate All Sessions'))
       ->setHref('/auth/session/terminate/all/')
       ->setTag('a')
       ->setWorkflow(true)
       ->setIcon('fa-exclamation-triangle');
 
     $header = id(new PHUIHeaderView())
       ->setHeader(pht('Active Login Sessions'))
       ->addActionLink($terminate_button);
 
     $hisec = ($viewer->getSession()->getHighSecurityUntil() - time());
     if ($hisec > 0) {
       $hisec_button = id(new PHUIButtonView())
         ->setText(pht('Leave High Security'))
         ->setHref('/auth/session/downgrade/')
         ->setTag('a')
         ->setWorkflow(true)
         ->setIcon('fa-lock');
       $header->addActionLink($hisec_button);
     }
 
     $panel = id(new PHUIObjectBoxView())
       ->setHeader($header)
       ->setTable($table);
 
     return $panel;
   }
 
 }
diff --git a/src/infrastructure/util/PhabricatorHash.php b/src/infrastructure/util/PhabricatorHash.php
index dc13b85dbe..19c8414539 100644
--- a/src/infrastructure/util/PhabricatorHash.php
+++ b/src/infrastructure/util/PhabricatorHash.php
@@ -1,227 +1,230 @@
 <?php
 
 final class PhabricatorHash extends Phobject {
 
   const INDEX_DIGEST_LENGTH = 12;
 
   /**
-   * Digest a string for general use, including use which relates to security.
+   * Digest a string using HMAC+SHA1.
+   *
+   * Because a SHA1 collision is now known, this method should be considered
+   * weak. Callers should prefer @{method:digestWithNamedKey}.
    *
    * @param   string  Input string.
    * @return  string  32-byte hexidecimal SHA1+HMAC hash.
    */
-  public static function digest($string, $key = null) {
+  public static function weakDigest($string, $key = null) {
     if ($key === null) {
       $key = PhabricatorEnv::getEnvConfig('security.hmac-key');
     }
 
     if (!$key) {
       throw new Exception(
         pht(
           "Set a '%s' in your Phabricator configuration!",
           'security.hmac-key'));
     }
 
     return hash_hmac('sha1', $string, $key);
   }
 
 
   /**
    * Digest a string into a password hash. This is similar to @{method:digest},
    * but requires a salt and iterates the hash to increase cost.
    */
   public static function digestPassword(PhutilOpaqueEnvelope $envelope, $salt) {
     $result = $envelope->openEnvelope();
     if (!$result) {
       throw new Exception(pht('Trying to digest empty password!'));
     }
 
     for ($ii = 0; $ii < 1000; $ii++) {
-      $result = self::digest($result, $salt);
+      $result = self::weakDigest($result, $salt);
     }
 
     return $result;
   }
 
 
   /**
    * Digest a string for use in, e.g., a MySQL index. This produces a short
    * (12-byte), case-sensitive alphanumeric string with 72 bits of entropy,
    * which is generally safe in most contexts (notably, URLs).
    *
    * This method emphasizes compactness, and should not be used for security
    * related hashing (for general purpose hashing, see @{method:digest}).
    *
    * @param   string  Input string.
    * @return  string  12-byte, case-sensitive alphanumeric hash of the string
    *                  which
    */
   public static function digestForIndex($string) {
     $hash = sha1($string, $raw_output = true);
 
     static $map;
     if ($map === null) {
       $map = '0123456789'.
              'abcdefghij'.
              'klmnopqrst'.
              'uvwxyzABCD'.
              'EFGHIJKLMN'.
              'OPQRSTUVWX'.
              'YZ._';
     }
 
     $result = '';
     for ($ii = 0; $ii < self::INDEX_DIGEST_LENGTH; $ii++) {
       $result .= $map[(ord($hash[$ii]) & 0x3F)];
     }
 
     return $result;
   }
 
   public static function digestToRange($string, $min, $max) {
     if ($min > $max) {
       throw new Exception(pht('Maximum must be larger than minimum.'));
     }
 
     if ($min == $max) {
       return $min;
     }
 
     $hash = sha1($string, $raw_output = true);
     // Make sure this ends up positive, even on 32-bit machines.
     $value = head(unpack('L', $hash)) & 0x7FFFFFFF;
 
     return $min + ($value % (1 + $max - $min));
   }
 
 
   /**
    * Shorten a string to a maximum byte length in a collision-resistant way
    * while retaining some degree of human-readability.
    *
    * This function converts an input string into a prefix plus a hash. For
    * example, a very long string beginning with "crabapplepie..." might be
    * digested to something like "crabapp-N1wM1Nz3U84k".
    *
    * This allows the maximum length of identifiers to be fixed while
    * maintaining a high degree of collision resistance and a moderate degree
    * of human readability.
    *
    * @param string The string to shorten.
    * @param int Maximum length of the result.
    * @return string String shortened in a collision-resistant way.
    */
   public static function digestToLength($string, $length) {
     // We need at least two more characters than the hash length to fit in a
     // a 1-character prefix and a separator.
     $min_length = self::INDEX_DIGEST_LENGTH + 2;
     if ($length < $min_length) {
       throw new Exception(
         pht(
           'Length parameter in %s must be at least %s, '.
           'but %s was provided.',
           'digestToLength()',
           new PhutilNumber($min_length),
           new PhutilNumber($length)));
     }
 
     // We could conceivably return the string unmodified if it's shorter than
     // the specified length. Instead, always hash it. This makes the output of
     // the method more recognizable and consistent (no surprising new behavior
     // once you hit a string longer than `$length`) and prevents an attacker
     // who can control the inputs from intentionally using the hashed form
     // of a string to cause a collision.
 
     $hash = self::digestForIndex($string);
 
     $prefix = substr($string, 0, ($length - ($min_length - 1)));
 
     return $prefix.'-'.$hash;
   }
 
   public static function digestWithNamedKey($message, $key_name) {
     $key_bytes = self::getNamedHMACKey($key_name);
     return self::digestHMACSHA256($message, $key_bytes);
   }
 
   public static function digestHMACSHA256($message, $key) {
     if (!strlen($key)) {
       throw new Exception(
         pht('HMAC-SHA256 requires a nonempty key.'));
     }
 
     $result = hash_hmac('sha256', $message, $key, $raw_output = false);
 
     if ($result === false) {
       throw new Exception(
         pht('Unable to compute HMAC-SHA256 digest of message.'));
     }
 
     return $result;
   }
 
 
 /* -(  HMAC Key Management  )------------------------------------------------ */
 
 
   private static function getNamedHMACKey($hmac_name) {
     $cache = PhabricatorCaches::getImmutableCache();
 
     $cache_key = "hmac.key({$hmac_name})";
 
     $hmac_key = $cache->getKey($cache_key);
     if (!strlen($hmac_key)) {
       $hmac_key = self::readHMACKey($hmac_name);
 
       if ($hmac_key === null) {
         $hmac_key = self::newHMACKey($hmac_name);
         self::writeHMACKey($hmac_name, $hmac_key);
       }
 
       $cache->setKey($cache_key, $hmac_key);
     }
 
     // The "hex2bin()" function doesn't exist until PHP 5.4.0 so just
     // implement it inline.
     $result = '';
     for ($ii = 0; $ii < strlen($hmac_key); $ii += 2) {
       $result .= pack('H*', substr($hmac_key, $ii, 2));
     }
 
     return $result;
   }
 
   private static function newHMACKey($hmac_name) {
     $hmac_key = Filesystem::readRandomBytes(64);
     return bin2hex($hmac_key);
   }
 
   private static function writeHMACKey($hmac_name, $hmac_key) {
     $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
 
       id(new PhabricatorAuthHMACKey())
         ->setKeyName($hmac_name)
         ->setKeyValue($hmac_key)
         ->save();
 
     unset($unguarded);
   }
 
   private static function readHMACKey($hmac_name) {
     $table = new PhabricatorAuthHMACKey();
     $conn = $table->establishConnection('r');
 
     $row = queryfx_one(
       $conn,
       'SELECT keyValue FROM %T WHERE keyName = %s',
       $table->getTableName(),
       $hmac_name);
     if (!$row) {
       return null;
     }
 
     return $row['keyValue'];
   }
 
 
 }