diff options
| author | czaks <marcin@6irc.net> | 2016-04-22 05:35:43 +0200 |
|---|---|---|
| committer | czaks <marcin@6irc.net> | 2016-04-22 05:35:43 +0200 |
| commit | caaf741691c9d44a9a186d6ce924fecb04f4f347 (patch) | |
| tree | 9b7c250ea732353f8053191b7772b4f6f8dbc7c6 /inc/mod/pages.php | |
| parent | 028fd3df15b2e2edc96c5b84156b0b039ea16562 (diff) | |
[SECURITY] keep up with modern password hashing standards
Diffstat (limited to 'inc/mod/pages.php')
| -rw-r--r-- | inc/mod/pages.php | 11 |
1 files changed, 4 insertions, 7 deletions
diff --git a/inc/mod/pages.php b/inc/mod/pages.php index 2c679b20..a07de4c7 100644 --- a/inc/mod/pages.php +++ b/inc/mod/pages.php @@ -1734,9 +1734,8 @@ function mod_user($uid) { } if ($_POST['password'] != '') { - $salt = generate_salt(); - $password = hash('sha256', $salt . sha1($_POST['password'])); - + list($salt, $password) = crypt_password($_POST['password']); + $query = prepare('UPDATE ``mods`` SET `password` = :password, `salt` = :salt WHERE `id` = :id'); $query->bindValue(':id', $uid); $query->bindValue(':password', $password); @@ -1761,8 +1760,7 @@ function mod_user($uid) { if (hasPermission($config['mod']['change_password']) && $uid == $mod['id'] && isset($_POST['password'])) { if ($_POST['password'] != '') { - $salt = generate_salt(); - $password = hash('sha256', $salt . sha1($_POST['password'])); + list($salt, $password) = crypt_password($_POST['password']); $query = prepare('UPDATE ``mods`` SET `password` = :password, `salt` = :salt WHERE `id` = :id'); $query->bindValue(':id', $uid); @@ -1834,8 +1832,7 @@ function mod_user_new() { if (!isset($config['mod']['groups'][$type]) || $type == DISABLED) error(sprintf($config['error']['invalidfield'], 'type')); - $salt = generate_salt(); - $password = hash('sha256', $salt . sha1($_POST['password'])); + list($salt, $password) = crypt_password($_POST['password']); $query = prepare('INSERT INTO ``mods`` VALUES (NULL, :username, :password, :salt, :type, :boards)'); $query->bindValue(':username', $_POST['username']); |