lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

use instance_unique_id

Browse Source
This commit is contained in:
Frédéric FRANCE 2023-05-03 12:01:36 +02:00
parent b1e62d7297
commit e4ec6f0b63
3 changed files with 16 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
htdocs/core/lib/security.lib.php
View File

@ -108,11 +108,11 @@ function dolGetRandomBytes($length)
/** /**
* Encode a string with a symetric encryption. Used to encrypt sensitive data into database. * Encode a string with a symetric encryption. Used to encrypt sensitive data into database.
* Note: If a backup is restored onto another instance with a different $dolibarr_main_instance_unique_id, then decoded value will differ. * Note: If a backup is restored onto another instance with a different $conf->file->instance_unique_id, then decoded value will differ.
* This function is called for example by dol_set_const() when saving a sensible data into database configuration table llx_const. * This function is called for example by dol_set_const() when saving a sensible data into database configuration table llx_const.
* *
* @param string $chain string to encode * @param string $chain string to encode
* @param string $key If '', we use $dolibarr_main_instance_unique_id * @param string $key If '', we use $conf->file->instance_unique_id
* @param string $ciphering Default ciphering algorithm * @param string $ciphering Default ciphering algorithm
* @param string $forceseed To force the seed * @param string $forceseed To force the seed
* @return string encoded string * @return string encoded string
@ -120,7 +120,7 @@ function dolGetRandomBytes($length)
*/ */
function dolEncrypt($chain, $key = '', $ciphering = 'AES-256-CTR', $forceseed = '') function dolEncrypt($chain, $key = '', $ciphering = 'AES-256-CTR', $forceseed = '')
{ {
global $dolibarr_main_instance_unique_id; global $conf;
global $dolibarr_disable_dolcrypt_for_debug; global $dolibarr_disable_dolcrypt_for_debug;
if ($chain === '' || is_null($chain)) { if ($chain === '' || is_null($chain)) {
@ -134,7 +134,7 @@ function dolEncrypt($chain, $key = '', $ciphering = 'AES-256-CTR', $forceseed =
} }
if (empty($key)) { if (empty($key)) {
$key = $dolibarr_main_instance_unique_id; $key = $conf->file->instance_unique_id;
} }
if (empty($ciphering)) { if (empty($ciphering)) {
$ciphering = 'AES-256-CTR'; $ciphering = 'AES-256-CTR';
@ -165,23 +165,23 @@ function dolEncrypt($chain, $key = '', $ciphering = 'AES-256-CTR', $forceseed =
/** /**
* Decode a string with a symetric encryption. Used to decrypt sensitive data saved into database. * Decode a string with a symetric encryption. Used to decrypt sensitive data saved into database.
* Note: If a backup is restored onto another instance with a different $dolibarr_main_instance_unique_id, then decoded value will differ. * Note: If a backup is restored onto another instance with a different $conf->file->instance_unique_id, then decoded value will differ.
* *
* @param string $chain string to encode * @param string $chain string to encode
* @param string $key If '', we use $dolibarr_main_instance_unique_id * @param string $key If '', we use $conf->file->instance_unique_id
* @return string encoded string * @return string encoded string
* @see dolEncrypt(), dol_hash() * @see dolEncrypt(), dol_hash()
*/ */
function dolDecrypt($chain, $key = '') function dolDecrypt($chain, $key = '')
{ {
global $dolibarr_main_instance_unique_id; global $conf;
if ($chain === '' || is_null($chain)) { if ($chain === '' || is_null($chain)) {
return ''; return '';
} }
if (empty($key)) { if (empty($key)) {
$key = $dolibarr_main_instance_unique_id; $key = $conf->file->instance_unique_id;
} }
$reg = array(); $reg = array();

10
htdocs/user/class/user.class.php
View File

@ -2451,11 +2451,11 @@ class User extends CommonObject
dol_syslog(get_class($this)."::send_password changelater is off, url=".$url); dol_syslog(get_class($this)."::send_password changelater is off, url=".$url);
} else { } else {
global $dolibarr_main_instance_unique_id; global $conf;
//print $password.'-'.$this->id.'-'.$dolibarr_main_instance_unique_id; //print $password.'-'.$this->id.'-'.$conf->file->instance_unique_id;
$url = $urlwithroot.'/user/passwordforgotten.php?action=validatenewpassword'; $url = $urlwithroot.'/user/passwordforgotten.php?action=validatenewpassword';
$url .= '&username='.urlencode($this->login)."&passworduidhash=".urlencode(dol_hash($password.'-'.$this->id.'-'.$dolibarr_main_instance_unique_id)); $url .= '&username='.urlencode($this->login)."&passworduidhash=".urlencode(dol_hash($password.'-'.$this->id.'-'.$conf->file->instance_unique_id));
if (isModEnabled('multicompany')) { if (isModEnabled('multicompany')) {
$url .= '&entity='.(!empty($this->entity) ? $this->entity : 1); $url .= '&entity='.(!empty($this->entity) ? $this->entity : 1);
} }
@ -3894,10 +3894,10 @@ class User extends CommonObject
*/ */
public function getOnlineVirtualCardUrl($mode = '', $typeofurl = 'external') public function getOnlineVirtualCardUrl($mode = '', $typeofurl = 'external')
{ {
global $dolibarr_main_instance_unique_id, $dolibarr_main_url_root; global $dolibarr_main_url_root;
global $conf; global $conf;
$encodedsecurekey = dol_hash($dolibarr_main_instance_unique_id.'uservirtualcard'.$this->id.'-'.$this->login, 'md5'); $encodedsecurekey = dol_hash($conf->file->instance_unique_id.'uservirtualcard'.$this->id.'-'.$this->login, 'md5');
if (isModEnabled('multicompany')) { if (isModEnabled('multicompany')) {
$entity_qr = '&entity='.((int) $conf->entity); $entity_qr = '&entity='.((int) $conf->entity);
} else { } else {

6
htdocs/user/passwordforgotten.php
View File

@ -94,10 +94,10 @@ if (empty($reshook)) {
if ($result < 0) { if ($result < 0) {
$message = '<div class="error">'.dol_escape_htmltag($langs->trans("ErrorTechnicalError")).'</div>'; $message = '<div class="error">'.dol_escape_htmltag($langs->trans("ErrorTechnicalError")).'</div>';
} else { } else {
global $dolibarr_main_instance_unique_id; global $conf;
//print $edituser->pass_temp.'-'.$edituser->id.'-'.$dolibarr_main_instance_unique_id.' '.$passworduidhash; //print $edituser->pass_temp.'-'.$edituser->id.'-'.$conf->file->instance_unique_id.' '.$passworduidhash;
if ($edituser->pass_temp && dol_verifyHash($edituser->pass_temp.'-'.$edituser->id.'-'.$dolibarr_main_instance_unique_id, $passworduidhash)) { if ($edituser->pass_temp && dol_verifyHash($edituser->pass_temp.'-'.$edituser->id.'-'.$conf->file->instance_unique_id, $passworduidhash)) {
// Clear session // Clear session
unset($_SESSION['dol_login']); unset($_SESSION['dol_login']);
$_SESSION['dol_loginmesg'] = '<!-- warning -->'.$langs->transnoentitiesnoconv('NewPasswordValidated'); // Save message for the session page $_SESSION['dol_loginmesg'] = '<!-- warning -->'.$langs->transnoentitiesnoconv('NewPasswordValidated'); // Save message for the session page