Mibew/i18n
1
0
Fork 0
mirror of https://github.com/Mibew/i18n.git synced 2025-01-23 05:40:30 +03:00
Code Issues Actions Packages Projects Releases Wiki Activity

Improve passwords hashing and testing

Browse Source 
* Fix issue with failed blowfish-based encryption (see second part of Issue #7)
* Switch to binary safe hashes comparison
This commit is contained in:
Fedor A. Fetisov 2013-09-24 20:07:07 +04:00
parent 239e62d979
commit 96e1f4047e
1 changed files with 9 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
src/messenger/webim/libs/operator.php
View File

@ -408,31 +408,31 @@ function get_operator_groupids($operatorid)
function calculate_password_hash($login, $password) function calculate_password_hash($login, $password)
{ {
$hash = '*0';
if (CRYPT_BLOWFISH == 1) { if (CRYPT_BLOWFISH == 1) {
if (defined('PHP_VERSION_ID') && (PHP_VERSION_ID > 50306)) { if (defined('PHP_VERSION_ID') && (PHP_VERSION_ID > 50306)) {
return crypt($password, '$2y$08$' . $login); $hash = crypt($password, '$2y$08$' . $login);
} }
else { else {
return crypt($password, '$2a$08$' . $login); $hash = crypt($password, '$2a$08$' . $login);
} }
} }
else if (CRYPT_MD5 == 1) {
return crypt($password, '$1$' . $login); if ( (CRYPT_MD5 == 1) && !strcmp($hash, '*0') ) {
$hash = crypt($password, '$1$' . $login);
} }
return md5($password); return strcmp($hash, '*0') ? $hash : md5($password);
} }
function check_password_hash($login, $password, $hash) function check_password_hash($login, $password, $hash)
{ {
if (preg_match('/^\$/', $hash)) { if (preg_match('/^\$/', $hash)) {
return (calculate_password_hash($login, $password) == $hash); return !strcmp(calculate_password_hash($login, $password), $hash);
} }
else { else {
return (md5($password) == $hash); return !strcmp(md5($password), $hash);
} }
} }
?> ?>