#1138 Show warning for hashes that will be deprecated in 5.4

- Introduce Usage.DEPRECATED to mark the hash algorithms accordingly
- Log warning when such a deprecated hash algorithm is used
- Update hash algorithms doc page

src/main/java/fr/xephi/authme/AuthMe.java

@@ -26,6 +26,7 @@ import fr.xephi.authme.listener.PlayerListener19;
 import fr.xephi.authme.listener.ServerListener;
 import fr.xephi.authme.permission.PermissionsManager;
 import fr.xephi.authme.permission.PermissionsSystemType;
+import fr.xephi.authme.security.HashAlgorithm;
 import fr.xephi.authme.security.crypts.Sha256;
 import fr.xephi.authme.service.BackupService;
 import fr.xephi.authme.service.BukkitService;
@@ -148,7 +149,8 @@ public class AuthMe extends JavaPlugin {
 
         // If server is using PermissionsBukkit, print a warning that some features may not be supported
         if (PermissionsSystemType.PERMISSIONS_BUKKIT.equals(permsMan.getPermissionSystem())) {
-            ConsoleLogger.warning("Warning! This server uses PermissionsBukkit for permissions. Some permissions features may not be supported!");
+            ConsoleLogger.warning("Warning! This server uses PermissionsBukkit for permissions. Some permissions "
+                + "features may not be supported!");
         }
 
         // Do a backup on start
@@ -159,10 +161,12 @@ public class AuthMe extends JavaPlugin {
 
         // Sponsor messages
         ConsoleLogger.info("Development builds are available on our jenkins, thanks to f14stelt.");
-        ConsoleLogger.info("Do you want a good game server? Look at our sponsor GameHosting.it leader in Italy as Game Server Provider!");
+        ConsoleLogger.info("Do you want a good game server? Look at our sponsor GameHosting.it leader "
+            + "in Italy as Game Server Provider!");
 
         // Successful message
-        ConsoleLogger.info("AuthMe " + getPluginVersion() + " build n." + getPluginBuildNumber() + " correctly enabled!");
+        ConsoleLogger.info("AuthMe " + getPluginVersion() + " build n." + getPluginBuildNumber()
+            + " correctly enabled!");
 
         // Purge on start if enabled
         PurgeService purgeService = injector.getSingleton(PurgeService.class);
@@ -248,7 +252,7 @@ public class AuthMe extends JavaPlugin {
      *
      * @param injector the injector
      */
-    protected void instantiateServices(Injector injector) {
+    void instantiateServices(Injector injector) {
         // PlayerCache is still injected statically sometimes
         PlayerCache playerCache = PlayerCache.getInstance();
         injector.register(PlayerCache.class, playerCache);
@@ -283,6 +287,14 @@ public class AuthMe extends JavaPlugin {
             && settings.getProperty(EmailSettings.SMTP_PORT) != 25) {
             ConsoleLogger.warning("Note: You have set Email.useTls to false but this only affects mail over port 25");
         }
+
+        // Unsalted hashes will be deprecated in 5.4 (see Github issue #1016). Exclude RoyalAuth from this check because
+        // it is needed to hook into an existing system.
+        HashAlgorithm hash = settings.getProperty(SecuritySettings.PASSWORD_HASH);
+        if (OnStartupTasks.isHashDeprecatedIn54(hash)) {
+            ConsoleLogger.warning("You are using an unsalted hash (" + hash + "). Support for this will be removed "
+                + "in 5.4 -- do you still need it? Comment on https://github.com/Xephi/AuthMeReloaded/issues/1016");
+        }
     }
 
     /**
@@ -290,7 +302,7 @@ public class AuthMe extends JavaPlugin {
      *
      * @param injector the injector
      */
-    protected void registerEventListeners(Injector injector) {
+    void registerEventListeners(Injector injector) {
         // Get the plugin manager instance
         PluginManager pluginManager = getServer().getPluginManager();
 

src/main/java/fr/xephi/authme/initialization/OnStartupTasks.java

@@ -7,6 +7,9 @@ import fr.xephi.authme.data.auth.PlayerAuth;
 import fr.xephi.authme.datasource.DataSource;
 import fr.xephi.authme.message.MessageKey;
 import fr.xephi.authme.message.Messages;
+import fr.xephi.authme.security.HashAlgorithm;
+import fr.xephi.authme.security.crypts.description.Recommendation;
+import fr.xephi.authme.security.crypts.description.Usage;
 import org.bstats.Metrics;
 import fr.xephi.authme.output.ConsoleFilter;
 import fr.xephi.authme.output.Log4JFilter;
@@ -138,4 +141,23 @@ public class OnStartupTasks {
             }
         }
     }
+
+    /**
+     * Returns whether the hash algorithm is deprecated and won't be able
+     * to be actively used anymore in 5.4.
+     *
+     * @param hash the hash algorithm to check
+     * @return true if the hash will be deprecated, false otherwise
+     * @see <a href="https://github.com/Xephi/AuthMeReloaded/issues/1016">#1016</a>
+     */
+    public static boolean isHashDeprecatedIn54(HashAlgorithm hash) {
+        if (hash.getClazz() == null || hash == HashAlgorithm.PLAINTEXT) {
+            // Exclude PLAINTEXT from this check because it already has a mandatory migration, which takes care of
+            // sending all the necessary messages and warnings.
+            return false;
+        }
+
+        Recommendation recommendation = hash.getClazz().getAnnotation(Recommendation.class);
+        return recommendation != null && recommendation.value() == Usage.DEPRECATED;
+    }
 }

src/main/java/fr/xephi/authme/security/crypts/DoubleMd5.java

@@ -1,7 +1,11 @@
 package fr.xephi.authme.security.crypts;
 
+import fr.xephi.authme.security.crypts.description.Recommendation;
+import fr.xephi.authme.security.crypts.description.Usage;
+
 import static fr.xephi.authme.security.HashUtils.md5;
 
+@Recommendation(Usage.DEPRECATED)
 public class DoubleMd5 extends UnsaltedMethod {
 
     @Override

src/main/java/fr/xephi/authme/security/crypts/Md5.java

@@ -1,7 +1,10 @@
 package fr.xephi.authme.security.crypts;
 
 import fr.xephi.authme.security.HashUtils;
+import fr.xephi.authme.security.crypts.description.Recommendation;
+import fr.xephi.authme.security.crypts.description.Usage;
 
+@Recommendation(Usage.DEPRECATED)
 public class Md5 extends UnsaltedMethod {
 
     @Override

src/main/java/fr/xephi/authme/security/crypts/PlainText.java

@@ -1,11 +1,15 @@
 package fr.xephi.authme.security.crypts;
 
+import fr.xephi.authme.security.crypts.description.Recommendation;
+import fr.xephi.authme.security.crypts.description.Usage;
+
 /**
  * Plaintext password storage.
  *
  * @deprecated Using this is no longer supported. AuthMe will migrate to SHA256 on startup.
  */
 @Deprecated
+@Recommendation(Usage.DEPRECATED)
 public class PlainText extends UnsaltedMethod {
 
     @Override

src/main/java/fr/xephi/authme/security/crypts/Sha1.java

@@ -1,7 +1,10 @@
 package fr.xephi.authme.security.crypts;
 
 import fr.xephi.authme.security.HashUtils;
+import fr.xephi.authme.security.crypts.description.Recommendation;
+import fr.xephi.authme.security.crypts.description.Usage;
 
+@Recommendation(Usage.DEPRECATED)
 public class Sha1 extends UnsaltedMethod {
 
     @Override

src/main/java/fr/xephi/authme/security/crypts/Sha512.java

@@ -1,7 +1,10 @@
 package fr.xephi.authme.security.crypts;
 
 import fr.xephi.authme.security.HashUtils;
+import fr.xephi.authme.security.crypts.description.Recommendation;
+import fr.xephi.authme.security.crypts.description.Usage;
 
+@Recommendation(Usage.DEPRECATED)
 public class Sha512 extends UnsaltedMethod {
 
     @Override

src/main/java/fr/xephi/authme/security/crypts/Whirlpool.java

@@ -59,8 +59,12 @@ package fr.xephi.authme.security.crypts;
  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+import fr.xephi.authme.security.crypts.description.Recommendation;
+import fr.xephi.authme.security.crypts.description.Usage;
+
 import java.util.Arrays;
 
+@Recommendation(Usage.DEPRECATED)
 public class Whirlpool extends UnsaltedMethod {
 
     /**

src/main/java/fr/xephi/authme/security/crypts/description/Usage.java

@@ -20,6 +20,9 @@ public enum Usage {
     /** Hash algorithm is not recommended to be used. Use only if required by another system. */
     DO_NOT_USE,
 
+    /** Algorithm that is or will be no longer supported actively. */
+    DEPRECATED,
+
     /** The algorithm does not work properly; do not use. */
     DOES_NOT_WORK