summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rwxr-xr-xinc/functions.php2
-rw-r--r--inc/mod/auth.php10
-rw-r--r--inc/mod/pages.php18
-rw-r--r--inc/polyfill.php28
-rw-r--r--install.php4
-rw-r--r--install.sql2
6 files changed, 48 insertions, 16 deletions
diff --git a/inc/functions.php b/inc/functions.php
index 515e3e55..3f5ed3b0 100755
--- a/inc/functions.php
+++ b/inc/functions.php
@@ -18,6 +18,8 @@ require_once 'inc/template.php';
require_once 'inc/database.php';
require_once 'inc/events.php';
require_once 'inc/api.php';
+require_once 'inc/polyfill.php';
+
if (!extension_loaded('gettext')) {
require_once 'inc/lib/gettext/gettext.inc';
}
diff --git a/inc/mod/auth.php b/inc/mod/auth.php
index fa1a0f4f..d877b89f 100644
--- a/inc/mod/auth.php
+++ b/inc/mod/auth.php
@@ -76,20 +76,20 @@ function generate_salt() {
function login($username, $password) {
global $mod, $config;
- $query = prepare("SELECT `id`, `type`, `boards`, `password`, `salt` FROM ``mods`` WHERE `username` = :username");
+ $query = prepare("SELECT `id`, `type`, `boards`, `password`, `version` FROM ``mods`` WHERE `username` = :username");
$query->bindValue(':username', $username);
$query->execute() or error(db_error($query));
if ($user = $query->fetch(PDO::FETCH_ASSOC)) {
- list($version, $ok) = test_password($user['password'], $user['salt'], $password);
+ list($version, $ok) = test_password($user['password'], $user['version'], $password);
if ($ok) {
if ($config['password_crypt_version'] > $version) {
// It's time to upgrade the password hashing method!
- list ($user['salt'], $user['password']) = crypt_password($password);
- $query = prepare("UPDATE ``mods`` SET `password` = :password, `salt` = :salt WHERE `id` = :id");
+ list ($user['version'], $user['password']) = crypt_password($password);
+ $query = prepare("UPDATE ``mods`` SET `password` = :password, `version` = :version WHERE `id` = :id");
$query->bindValue(':password', $user['password']);
- $query->bindValue(':salt', $user['salt']);
+ $query->bindValue(':version', $user['version']);
$query->bindValue(':id', $user['id']);
$query->execute() or error(db_error($query));
}
diff --git a/inc/mod/pages.php b/inc/mod/pages.php
index a07de4c7..8b6f73c4 100644
--- a/inc/mod/pages.php
+++ b/inc/mod/pages.php
@@ -1734,12 +1734,12 @@ function mod_user($uid) {
}
if ($_POST['password'] != '') {
- list($salt, $password) = crypt_password($_POST['password']);
+ list($version, $password) = crypt_password($_POST['password']);
- $query = prepare('UPDATE ``mods`` SET `password` = :password, `salt` = :salt WHERE `id` = :id');
+ $query = prepare('UPDATE ``mods`` SET `password` = :password, `version` = :version WHERE `id` = :id');
$query->bindValue(':id', $uid);
$query->bindValue(':password', $password);
- $query->bindValue(':salt', $salt);
+ $query->bindValue(':version', $version);
$query->execute() or error(db_error($query));
modLog('Changed password for ' . utf8tohtml($_POST['username']) . ' <small>(#' . $user['id'] . ')</small>');
@@ -1760,12 +1760,12 @@ function mod_user($uid) {
if (hasPermission($config['mod']['change_password']) && $uid == $mod['id'] && isset($_POST['password'])) {
if ($_POST['password'] != '') {
- list($salt, $password) = crypt_password($_POST['password']);
+ list($version, $password) = crypt_password($_POST['password']);
- $query = prepare('UPDATE ``mods`` SET `password` = :password, `salt` = :salt WHERE `id` = :id');
+ $query = prepare('UPDATE ``mods`` SET `password` = :password, `version` = :version WHERE `id` = :id');
$query->bindValue(':id', $uid);
$query->bindValue(':password', $password);
- $query->bindValue(':salt', $salt);
+ $query->bindValue(':version', $version);
$query->execute() or error(db_error($query));
modLog('Changed own password');
@@ -1832,12 +1832,12 @@ function mod_user_new() {
if (!isset($config['mod']['groups'][$type]) || $type == DISABLED)
error(sprintf($config['error']['invalidfield'], 'type'));
- list($salt, $password) = crypt_password($_POST['password']);
+ list($version, $password) = crypt_password($_POST['password']);
- $query = prepare('INSERT INTO ``mods`` VALUES (NULL, :username, :password, :salt, :type, :boards)');
+ $query = prepare('INSERT INTO ``mods`` VALUES (NULL, :username, :password, :version, :type, :boards)');
$query->bindValue(':username', $_POST['username']);
$query->bindValue(':password', $password);
- $query->bindValue(':salt', $salt);
+ $query->bindValue(':version', $version);
$query->bindValue(':type', $type);
$query->bindValue(':boards', implode(',', $boards));
$query->execute() or error(db_error($query));
diff --git a/inc/polyfill.php b/inc/polyfill.php
new file mode 100644
index 00000000..ac40a00a
--- /dev/null
+++ b/inc/polyfill.php
@@ -0,0 +1,28 @@
+<?php
+
+// PHP 5.4
+
+if (!function_exists('hex2bin')) {
+ function hex2bin($data) {
+ return pack("H*" , $hex_string);
+ }
+}
+
+// PHP 5.6
+
+if (!function_exists('hash_equals')) {
+ function hash_equals($ours, $theirs) {
+ $ours = (string)$ours;
+ $theirs = (string)$theirs;
+
+ $tlen = strlen($theirs);
+ $olen = strlen($ours);
+
+ $answer = 0;
+ for ($i = 0; $i < $tlen; $i++) {
+ $answer |= ord($ours[$olen > $i ? $i : 0]) ^ ord($theirs[$i]);
+ }
+
+ return $answer === 0 && $olen === $tlen;
+ }
+}
diff --git a/install.php b/install.php
index 5a2d724a..968c41de 100644
--- a/install.php
+++ b/install.php
@@ -1,7 +1,7 @@
<?php
// Installation/upgrade file
-define('VERSION', '5.0.0');
+define('VERSION', '5.0.1');
require 'inc/functions.php';
@@ -556,6 +556,8 @@ if (file_exists($config['has_installed'])) {
case '4.9.93':
query('ALTER TABLE ``mods`` CHANGE `password` `password` VARCHAR(255) NOT NULL;') or error(db_error());
query('ALTER TABLE ``mods`` CHANGE `salt` `salt` VARCHAR(64) NOT NULL;') or error(db_error());
+ case '5.0.0':
+ query('ALTER TABLE ``mods`` CHANGE `salt` `version` VARCHAR(64) NOT NULL;') or error(db_error());
case false:
// TODO: enhance Tinyboard -> vichan upgrade path.
query("CREATE TABLE IF NOT EXISTS ``search_queries`` ( `ip` varchar(39) NOT NULL, `time` int(11) NOT NULL, `query` text NOT NULL) ENGINE=MyISAM DEFAULT CHARSET=utf8;") or error(db_error());
diff --git a/install.sql b/install.sql
index fbf220c1..7e661450 100644
--- a/install.sql
+++ b/install.sql
@@ -132,7 +132,7 @@ CREATE TABLE IF NOT EXISTS `mods` (
`id` smallint(6) unsigned NOT NULL AUTO_INCREMENT,
`username` varchar(30) NOT NULL,
`password` varchar(256) CHARACTER SET ascii NOT NULL COMMENT 'SHA256',
- `salt` varchar(64) CHARACTER SET ascii NOT NULL,
+ `version` varchar(64) CHARACTER SET ascii NOT NULL,
`type` smallint(2) NOT NULL,
`boards` text CHARACTER SET utf8 NOT NULL,
PRIMARY KEY (`id`),
generated by cgit v1.3 (git 2.53.0) at 2026-10-25 18:04:04 +0000