lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Can still connect if option do not save clear password is reversed.

Browse Source
This commit is contained in:
Laurent Destailleur 2008-11-19 18:19:51 +00:00
parent 3ad5d6b566
commit 03010ac770
3 changed files with 21 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
htdocs/admin/security.php
View File

@ -61,9 +61,11 @@ if ($_GET["action"] == 'activate_encrypt')
$db->begin(); $db->begin();
dolibarr_set_const($db, "DATABASE_PWD_ENCRYPTED", "1"); dolibarr_set_const($db, "DATABASE_PWD_ENCRYPTED", "1");
$sql = "UPDATE ".MAIN_DB_PREFIX."user as u"; $sql = "UPDATE ".MAIN_DB_PREFIX."user as u";
$sql.= " SET u.pass = NULL AND u.pass_crypted = MD5(u.pass)"; $sql.= " SET u.pass_crypted = MD5(u.pass), u.pass = NULL";
$sql.= " WHERE u.pass IS NOT NULL AND LENGTH(u.pass) < 32"; // Not a MD5 value $sql.= " WHERE u.pass IS NOT NULL AND LENGTH(u.pass) < 32"; // Not a MD5 value
$sql.= " AND MD5(u.pass) IS NOT NULL";
//print $sql; //print $sql;
$result = $db->query($sql); $result = $db->query($sql);
@ -75,6 +77,7 @@ if ($_GET["action"] == 'activate_encrypt')
} }
else else
{ {
$db->rollback();
dolibarr_print_error($db,''); dolibarr_print_error($db,'');
} }
} }

18
htdocs/includes/login/functions_dolibarr.php
View File

@ -63,23 +63,33 @@ function check_user_password_dolibarr($usertotest,$passwordtotest)
// Check crypted password // Check crypted password
$cryptType=''; $cryptType='';
if ($conf->global->DATABASE_PWD_ENCRYPTED) $cryptType='md5'; if (! empty($conf->global->DATABASE_PWD_ENCRYPTED)) $cryptType=$conf->global->DATABASE_PWD_ENCRYPTED;
// By default, we used MD5
if (! in_array($cryptType,array('md5'))) $cryptType='md5';
// Check crypted password according to crypt algorithm
if ($cryptType == 'md5') if ($cryptType == 'md5')
{ {
if (md5($passtyped) == $passcrypted) $passok=true; if (md5($passtyped) == $passcrypted)
{
$passok=true;
dolibarr_syslog("functions_dolibarr::check_user_password_dolibarr Authentification ok - ".$cryptType." of pass is ok");
}
} }
// For compatibility with old versions // For compatibility with old versions
if (! $passok) if (! $passok)
{ {
if ((! $passcrypted || $passtyped) if ((! $passcrypted || $passtyped)
&& ($passtyped == $passclear)) $passok=true; && ($passtyped == $passclear))
{
$passok=true;
dolibarr_syslog("functions_dolibarr::check_user_password_dolibarr Authentification ok - found pass in database");
}
} }
// Password ok ? // Password ok ?
if ($passok) if ($passok)
{ {
dolibarr_syslog("functions_dolibarr::check_user_password_dolibarr Authentification ok");
$login=$_POST["username"]; $login=$_POST["username"];
} }
else else

6
htdocs/index.php
View File

@ -19,9 +19,9 @@
*/ */
/** /**
\file htdocs/index.php * \file htdocs/index.php
\brief Page accueil par defaut * \brief Page accueil par defaut
\version $Id$ * \version $Id$
*/ */
require("./pre.inc.php"); require("./pre.inc.php");