#1016 Deprecate MD5, SHA1, SHA512: no longer allowed for active use

- Deprecate unsalted hashes: if such a hash is configured, move it to the legacy hashes setting to still support the existing hashes in the database but hash all passwords from now on with our default, SHA256.

src/main/java/fr/xephi/authme/settings/EnumSetProperty.java

@@ -3,8 +3,8 @@ package fr.xephi.authme.settings;
 import ch.jalu.configme.properties.Property;
 import ch.jalu.configme.resource.PropertyResource;
 
+import java.util.Collection;
 import java.util.LinkedHashSet;
-import java.util.List;
 import java.util.Set;
 import java.util.stream.Collectors;
 
@@ -27,9 +27,9 @@ public class EnumSetProperty<E extends Enum<E>> extends Property<Set<E>> {
 
     @Override
     protected Set<E> getFromResource(PropertyResource resource) {
-        List<?> elements = resource.getList(getPath());
-        if (elements != null) {
-            return elements.stream()
+        Object entry = resource.getObject(getPath());
+        if (entry instanceof Collection<?>) {
+            return ((Collection<?>) entry).stream()
                 .map(val -> toEnum(String.valueOf(val)))
                 .filter(e -> e != null)
                 .collect(Collectors.toCollection(LinkedHashSet::new));

src/main/java/fr/xephi/authme/settings/SettingsMigrationService.java

@@ -10,6 +10,8 @@ import fr.xephi.authme.initialization.DataFolder;
 import fr.xephi.authme.output.LogLevel;
 import fr.xephi.authme.process.register.RegisterSecondaryArgument;
 import fr.xephi.authme.process.register.RegistrationType;
+import fr.xephi.authme.security.HashAlgorithm;
+import fr.xephi.authme.security.crypts.EncryptionMethod;
 import fr.xephi.authme.settings.properties.PluginSettings;
 import fr.xephi.authme.settings.properties.RegistrationSettings;
 import fr.xephi.authme.settings.properties.SecuritySettings;
@@ -20,6 +22,7 @@ import java.io.FileWriter;
 import java.io.IOException;
 import java.util.Collections;
 import java.util.List;
+import java.util.Set;
 
 import static ch.jalu.configme.properties.PropertyInitializer.newListProperty;
 import static ch.jalu.configme.properties.PropertyInitializer.newProperty;
@@ -73,6 +76,7 @@ public class SettingsMigrationService extends PlainMigrationService {
             | hasSupportOldPasswordProperty(resource)
             | convertToRegistrationType(resource)
             | mergeAndMovePermissionGroupSettings(resource)
+            | moveDeprecatedHashAlgorithmIntoLegacySection(resource)
             || hasDeprecatedProperties(resource);
     }
 
@@ -286,6 +290,31 @@ public class SettingsMigrationService extends PlainMigrationService {
         return performedChanges;
     }
 
+    /**
+     * If a deprecated hash is used, it is added to the legacy hashes option and the active hash
+     * is changed to SHA256.
+     *
+     * @param resource The property resource
+     * @return True if the configuration has changed, false otherwise
+     */
+    private static boolean moveDeprecatedHashAlgorithmIntoLegacySection(PropertyResource resource) {
+        HashAlgorithm currentHash = SecuritySettings.PASSWORD_HASH.getValue(resource);
+        // Skip CUSTOM (has no class) and PLAINTEXT (is force-migrated later on in the startup process)
+        if (currentHash != HashAlgorithm.CUSTOM && currentHash != HashAlgorithm.PLAINTEXT) {
+            Class<? extends EncryptionMethod> clazz = currentHash.getClazz();
+            if (clazz.isAnnotationPresent(Deprecated.class)) {
+                resource.setValue(SecuritySettings.PASSWORD_HASH.getPath(), HashAlgorithm.SHA256);
+                Set<HashAlgorithm> legacyHashes = SecuritySettings.LEGACY_HASHES.getValue(resource);
+                legacyHashes.add(currentHash);
+                resource.setValue(SecuritySettings.LEGACY_HASHES.getPath(), legacyHashes);
+                ConsoleLogger.warning("The hash algorithm '" + currentHash
+                    + "' is no longer supported for active use. New hashes will be in SHA256.");
+                return true;
+            }
+        }
+        return false;
+    }
+
     /**
      * Checks for an old property path and moves it to a new path if it is present and the new path is not yet set.
      *

src/main/java/fr/xephi/authme/settings/properties/SecuritySettings.java

@@ -53,7 +53,7 @@ public final class SecuritySettings implements SettingsHolder {
         newProperty("settings.security.passwordMaxLength", 30);
 
     @Comment({
-        "Possible values: SHA256, BCRYPT, BCRYPT2Y, PBKDF2, SALTEDSHA512, WHIRLPOOL,",
+        "Possible values: SHA256, BCRYPT, BCRYPT2Y, PBKDF2, SALTEDSHA512,",
         "MYBB, IPB3, PHPBB, PHPFUSION, SMF, XENFORO, XAUTH, JOOMLA, WBB3, WBB4, MD5VB,",
         "PBKDF2DJANGO, WORDPRESS, ROYALAUTH, CUSTOM (for developers only). See full list at",
         "https://github.com/AuthMe/AuthMeReloaded/blob/master/docs/hash_algorithms.md"