lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix: Test mot de passe incorrect en mode crypte

Browse Source
This commit is contained in:
Laurent Destailleur 2007-12-31 11:56:30 +00:00
parent e9ee5cdc41
commit d7c284244b
1 changed files with 21 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
htdocs/main.inc.php
View File

@ -211,7 +211,10 @@ if (! isset($_SESSION["dol_login"]))
$table = MAIN_DB_PREFIX."user"; $table = MAIN_DB_PREFIX."user";
$usernamecol = 'login'; $usernamecol = 'login';
$sql='SELECT '.$fieldtotest.' as password from '.$table.' where '.$usernamecol." = '".addslashes($_POST["username"])."'"; $sql ='SELECT pass, pass_crypted';
$sql.=' from '.$table;
$sql.=' where '.$usernamecol." = '".addslashes($_POST["username"])."'";
dolibarr_syslog("main.inc::get password sql=".$sql); dolibarr_syslog("main.inc::get password sql=".$sql);
$resql=$db->query($sql); $resql=$db->query($sql);
if ($resql) if ($resql)
@ -219,9 +222,23 @@ if (! isset($_SESSION["dol_login"]))
$obj=$db->fetch_object($resql); $obj=$db->fetch_object($resql);
if ($obj) if ($obj)
{ {
$password=$obj->password; $passclear=$obj->pass;
if ($cryptType == 'md5') $password=md5($password); $passcrypted=$obj->pass_crypted;
if ($password == $_POST["password"]) $passtyped=$_POST["password"];
$passok=false;
if ($cryptType == 'md5')
{
if (md5($passtyped) == $passcrypted) $passok=true;
}
// For compatibility with old versions
if (! $passok)
{
if ($passtyped == $passclear) $passok=true;
}
// Password ok ?
if ($passok)
{ {
dolibarr_syslog("Authentification ok (en mode Base Dolibarr)"); dolibarr_syslog("Authentification ok (en mode Base Dolibarr)");
$login=$_POST["username"]; $login=$_POST["username"];