diff --git a/htdocs/admin/security.php b/htdocs/admin/security.php
index 02cddbd5d70..063f1668d15 100644
--- a/htdocs/admin/security.php
+++ b/htdocs/admin/security.php
@@ -46,7 +46,7 @@ $allow_disable_encryption = true;
*/
if ($action == 'setgeneraterule') {
- if (!dolibarr_set_const($db, 'USER_PASSWORD_GENERATED', $_GET["value"], 'chaine', 0, '', $conf->entity)) {
+ if (!dolibarr_set_const($db, 'USER_PASSWORD_GENERATED', GETPOST("value", "alphanohtml"), 'chaine', 0, '', $conf->entity)) {
dol_print_error($db);
}
}
@@ -56,7 +56,11 @@ if ($action == 'activate_encrypt') {
$db->begin();
- dolibarr_set_const($db, "DATABASE_PWD_ENCRYPTED", "1", 'chaine', 0, '', $conf->entity);
+ // On old version a bug created the constant into user entity, so we delete it to be sure, such entry won't exists. We want it in entity 0 or nowhere.
+ dolibarr_del_const($db, "DATABASE_PWD_ENCRYPTED", "1", 'chaine', 0, '', $conf->entity);
+ // We set entity=0 (all) because DATABASE_PWD_ENCRYPTED is a setup into conf file, so always shared for everybody
+ $entityforall = 0;
+ dolibarr_set_const($db, "DATABASE_PWD_ENCRYPTED", "1", 'chaine', 0, '', $entityforall);
$sql = "SELECT u.rowid, u.pass, u.pass_crypted";
$sql .= " FROM ".MAIN_DB_PREFIX."user as u";
@@ -377,7 +381,8 @@ if ($conf->global->USER_PASSWORD_GENERATED == "Perso") {
}
-// Cryptage mot de passe
+// Crypt passwords in database
+
print '
';
print '