diff options
| author | Michael Foster <savetheinternet@tinyboard.org> | 2013-07-24 11:15:55 -0400 |
|---|---|---|
| committer | Michael Foster <savetheinternet@tinyboard.org> | 2013-07-24 11:15:55 -0400 |
| commit | 31f657e550ab8b1ea00953cc3a26f4661ee4458c (patch) | |
| tree | 2a04233caaacc672b0ead54ad8e1ce43649dc18f /inc/mod/pages.php | |
| parent | 46edec0f2d8c31b55e36e160c7d9bac8bf4d3aa4 (diff) | |
Long overdue: Salted password hashes
Diffstat (limited to 'inc/mod/pages.php')
| -rw-r--r-- | inc/mod/pages.php | 24 |
1 files changed, 18 insertions, 6 deletions
diff --git a/inc/mod/pages.php b/inc/mod/pages.php index cddecad0..1ed9a94b 100644 --- a/inc/mod/pages.php +++ b/inc/mod/pages.php @@ -1407,9 +1407,13 @@ function mod_user($uid) { } if ($_POST['password'] != '') { - $query = prepare('UPDATE `mods` SET `password` = SHA1(:password) WHERE `id` = :id'); + $salt = generate_salt(); + $password = hash('sha256', $salt . sha1($_POST['password'])); + + $query = prepare('UPDATE `mods` SET `password` = :password, `salt` = :salt WHERE `id` = :id'); $query->bindValue(':id', $uid); - $query->bindValue(':password', $_POST['password']); + $query->bindValue(':password', $password); + $query->bindValue(':salt', $salt); $query->execute() or error(db_error($query)); modLog('Changed password for ' . utf8tohtml($_POST['username']) . ' <small>(#' . $user['id'] . ')</small>'); @@ -1430,9 +1434,13 @@ function mod_user($uid) { if (hasPermission($config['mod']['change_password']) && $uid == $mod['id'] && isset($_POST['password'])) { if ($_POST['password'] != '') { - $query = prepare('UPDATE `mods` SET `password` = SHA1(:password) WHERE `id` = :id'); + $salt = generate_salt(); + $password = hash('sha256', $salt . sha1($_POST['password'])); + + $query = prepare('UPDATE `mods` SET `password` = :password, `salt` = :salt WHERE `id` = :id'); $query->bindValue(':id', $uid); - $query->bindValue(':password', $_POST['password']); + $query->bindValue(':password', $password); + $query->bindValue(':salt', $salt); $query->execute() or error(db_error($query)); modLog('Changed own password'); @@ -1494,9 +1502,13 @@ function mod_user_new() { if ($_POST['type'] !== JANITOR && $_POST['type'] !== MOD && $_POST['type'] !== ADMIN) error(sprintf($config['error']['invalidfield'], 'type')); - $query = prepare('INSERT INTO `mods` VALUES (NULL, :username, SHA1(:password), :type, :boards)'); + $salt = generate_salt(); + $password = hash('sha256', $salt . sha1($_POST['password'])); + + $query = prepare('INSERT INTO `mods` VALUES (NULL, :username, :password, :salt, :type, :boards)'); $query->bindValue(':username', $_POST['username']); - $query->bindValue(':password', $_POST['password']); + $query->bindValue(':password', $password); + $query->bindValue(':salt', $salt); $query->bindValue(':type', $_POST['type']); $query->bindValue(':boards', implode(',', $boards)); $query->execute() or error(db_error($query)); |