Mirrors/dolibarr
1
0
Fork 0
mirror of https://github.com/Dolibarr/dolibarr.git synced 2025-02-20 13:46:52 +01:00
Code Issues Packages Projects Releases Wiki Activity

Can still connect if option do not save clear password is reversed.

Browse Source
This commit is contained in:
Laurent Destailleur 2008-11-19 18:19:51 +00:00
parent 3ad5d6b566
commit 03010ac770
3 changed files with 21 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
htdocs/admin/security.php
View File

@ -61,9 +61,11 @@ if ($_GET["action"] == 'activate_encrypt')
$db->begin();
dolibarr_set_const($db, "DATABASE_PWD_ENCRYPTED", "1");
$sql = "UPDATE ".MAIN_DB_PREFIX."user as u";
$sql.= " SET u.pass = NULL AND u.pass_crypted = MD5(u.pass)";
$sql.= " SET u.pass_crypted = MD5(u.pass), u.pass = NULL";
$sql.= " WHERE u.pass IS NOT NULL AND LENGTH(u.pass) < 32"; // Not a MD5 value
$sql.= " AND MD5(u.pass) IS NOT NULL";
//print $sql;
$result = $db->query($sql);
@ -75,6 +77,7 @@ if ($_GET["action"] == 'activate_encrypt')
}
else
{
$db->rollback();
dolibarr_print_error($db,'');
}
}

18
htdocs/includes/login/functions_dolibarr.php
View File

@ -63,23 +63,33 @@ function check_user_password_dolibarr($usertotest,$passwordtotest)
// Check crypted password
$cryptType='';
if ($conf->global->DATABASE_PWD_ENCRYPTED) $cryptType='md5';
if (! empty($conf->global->DATABASE_PWD_ENCRYPTED)) $cryptType=$conf->global->DATABASE_PWD_ENCRYPTED;
// By default, we used MD5
if (! in_array($cryptType,array('md5'))) $cryptType='md5';
// Check crypted password according to crypt algorithm
if ($cryptType == 'md5')
{
if (md5($passtyped) == $passcrypted) $passok=true;
if (md5($passtyped) == $passcrypted)
{
$passok=true;
dolibarr_syslog("functions_dolibarr::check_user_password_dolibarr Authentification ok - ".$cryptType." of pass is ok");
}
}
// For compatibility with old versions
if (! $passok)
{
if ((! $passcrypted || $passtyped)
&& ($passtyped == $passclear)) $passok=true;
&& ($passtyped == $passclear))
{
$passok=true;
dolibarr_syslog("functions_dolibarr::check_user_password_dolibarr Authentification ok - found pass in database");
}
}
// Password ok ?
if ($passok)
{
dolibarr_syslog("functions_dolibarr::check_user_password_dolibarr Authentification ok");
$login=$_POST["username"];
}
else

6
htdocs/index.php
View File

@ -19,9 +19,9 @@
*/
/**
\file htdocs/index.php
\brief Page accueil par defaut
\version $Id$
* \file htdocs/index.php
* \brief Page accueil par defaut
* \version $Id$
*/
require("./pre.inc.php");