From 6739ec21c80f491d370c478a682795082cd438e3 Mon Sep 17 00:00:00 2001
From: the-djmaze <>
Date: Mon, 22 Apr 2024 15:55:31 +0200
Subject: [PATCH] Bugfix haveibeenpwned suffix handling

---
 plugins/haveibeenpwned/index.php | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/plugins/haveibeenpwned/index.php b/plugins/haveibeenpwned/index.php
index 178a457af..ed0048555 100644
--- a/plugins/haveibeenpwned/index.php
+++ b/plugins/haveibeenpwned/index.php
@@ -51,7 +51,9 @@ class HaveibeenpwnedPlugin extends \RainLoop\Plugins\AbstractPlugin
 		}
 
 		$pass = \sha1($oAccount->ImapPass());
-		$response = $HTTP->doRequest('GET', 'https://api.pwnedpasswords.com/range/' . \substr($pass, 0, 5));
+		$prefix = \substr($pass, 0, 5);
+		$suffix = \substr($pass, 5);
+		$response = $HTTP->doRequest('GET', "https://api.pwnedpasswords.com/range/{$prefix}");
 		$passwords = [];
 		foreach (\preg_split('/\\R/', $response->body) as $entry) {
 			if ($entry) {
@@ -61,8 +63,7 @@ class HaveibeenpwnedPlugin extends \RainLoop\Plugins\AbstractPlugin
 		}
 
 		return $this->jsonResponse(__FUNCTION__, array(
-			'pwned' => isset($passwords[$pass]) ? $passwords[$pass] : 0,
-//			'passwords' => $passwords,
+			'pwned' => isset($passwords[$suffix]) ? $passwords[$suffix] : 0,
 			'breached' => $breached ? [
 				'request_uri' => $breached->request_uri,
 				'final_uri' => $breached->final_uri,