CAllUser::LoginByHash

public function LoginByHash($login, $hash)
{
	/** @global CMain $APPLICATION */
	global $DB, $APPLICATION;

	$result_message = true;
	$userId = 0;
	$arParams = [
		"LOGIN" => $login,
		"HASH" => $hash,
	];

	$APPLICATION->ResetException();
	$bOk = true;
	foreach (GetModuleEvents('main', 'OnBeforeUserLoginByHash', true) as $arEvent)
	{
		if (ExecuteModuleEventEx($arEvent, [&$arParams]) === false)
		{
			if ($err = $APPLICATION->GetException())
			{
				$result_message = ["MESSAGE" => $err->GetString() . "
", "TYPE" => "ERROR"];
			}
			else
			{
				$APPLICATION->ThrowException("Unknown error");
				$result_message = ["MESSAGE" => "Unknown error" . "
", "TYPE" => "ERROR"];
			}

			$bOk = false;
			break;
		}
	}

	if ($bOk && $arParams['HASH'] != '')
	{
		$strSql =
			"SELECT U.ID, U.ACTIVE, U.EXTERNAL_AUTH_ID, U.BLOCKED " .
			"FROM b_user U " .
			"WHERE U.LOGIN = '" . $DB->ForSQL($arParams['LOGIN'], 50) . "' ";
		$result = $DB->Query($strSql);

		$found = false;
		while (($arUser = $result->Fetch()))
		{
			$userId = $arUser['ID'];

			//there is no stored auth for external authorization, but domain spread auth should work
			$bExternal = ($arUser["EXTERNAL_AUTH_ID"] != '');
			$bAllowExternalSave = Option::get('main', 'allow_external_auth_stored_hash', 'N') == 'Y';
			$tempHash = $bExternal && !$bAllowExternalSave;

			$context = (new AuthenticationContext())
				->setUserId($userId)
			;

			if (static::CheckStoredHash($context, $arParams['HASH'], $tempHash))
			{
				$found = true;
				if ($arUser["ACTIVE"] == 'Y' && $arUser["BLOCKED"] != 'Y')
				{
					$this->Authorize($context, !$tempHash);
				}
				else
				{
					$APPLICATION->ThrowException(GetMessage("LOGIN_BLOCK"));
					$result_message = ["MESSAGE" => GetMessage("LOGIN_BLOCK") . "
", "TYPE" => "ERROR"];
				}
				break;
			}
		}

		if (!$found)
		{
			//Delete invalid stored auth cookie
			$spread = (Option::get('main', 'auth_multisite', 'N') === 'Y' ? (MainWebCookie::SPREAD_SITES | MainWebCookie::SPREAD_DOMAIN) : MainWebCookie::SPREAD_DOMAIN);

			$cookie = (new MainWebCookie('UIDH', '', 0))
				->setSpread($spread)
				->setHttpOnly(true)
			;
			MainContext::getCurrent()->getResponse()->addCookie($cookie);

			$APPLICATION->ThrowException(GetMessage("WRONG_LOGIN"));
			$result_message = ["MESSAGE" => GetMessage("WRONG_LOGIN") . "
", "TYPE" => "ERROR"];
		}
	}

	$arParams["USER_ID"] = $userId;
	$arParams["RESULT_MESSAGE"] = $result_message;

	foreach (GetModuleEvents('main', 'OnAfterUserLoginByHash', true) as $arEvent)
	{
		ExecuteModuleEventEx($arEvent, [&$arParams]);
	}

	if ($result_message !== true && Option::get('main', 'event_log_login_fail', 'N') === 'Y')
	{
		CEventLog::Log('SECURITY', 'USER_LOGINBYHASH', 'main', $login, $result_message['MESSAGE']);
	}

	return $arParams["RESULT_MESSAGE"];
}