From 31f657e550ab8b1ea00953cc3a26f4661ee4458c Mon Sep 17 00:00:00 2001
From: Michael Foster <savetheinternet@tinyboard.org>
Date: Wed, 24 Jul 2013 11:15:55 -0400
Subject: Long overdue: Salted password hashes

---
 inc/mod/pages.php | 24 ++++++++++++++++++------
 1 file changed, 18 insertions(+), 6 deletions(-)

(limited to 'inc/mod/pages.php')

diff --git a/inc/mod/pages.php b/inc/mod/pages.php
index cddecad0..1ed9a94b 100644
--- a/inc/mod/pages.php
+++ b/inc/mod/pages.php
@@ -1407,9 +1407,13 @@ function mod_user($uid) {
 		}
 		
 		if ($_POST['password'] != '') {
-			$query = prepare('UPDATE `mods` SET `password` = SHA1(:password) WHERE `id` = :id');
+			$salt = generate_salt();
+			$password = hash('sha256', $salt . sha1($_POST['password']));
+			
+			$query = prepare('UPDATE `mods` SET `password` = :password, `salt` = :salt WHERE `id` = :id');
 			$query->bindValue(':id', $uid);
-			$query->bindValue(':password', $_POST['password']);
+			$query->bindValue(':password', $password);
+			$query->bindValue(':salt', $salt);
 			$query->execute() or error(db_error($query));
 			
 			modLog('Changed password for ' . utf8tohtml($_POST['username']) . ' <small>(#' . $user['id'] . ')</small>');
@@ -1430,9 +1434,13 @@ function mod_user($uid) {
 	
 	if (hasPermission($config['mod']['change_password']) && $uid == $mod['id'] && isset($_POST['password'])) {
 		if ($_POST['password'] != '') {
-			$query = prepare('UPDATE `mods` SET `password` = SHA1(:password) WHERE `id` = :id');
+			$salt = generate_salt();
+			$password = hash('sha256', $salt . sha1($_POST['password']));
+
+			$query = prepare('UPDATE `mods` SET `password` = :password, `salt` = :salt WHERE `id` = :id');
 			$query->bindValue(':id', $uid);
-			$query->bindValue(':password', $_POST['password']);
+			$query->bindValue(':password', $password);
+			$query->bindValue(':salt', $salt);
 			$query->execute() or error(db_error($query));
 			
 			modLog('Changed own password');
@@ -1494,9 +1502,13 @@ function mod_user_new() {
 		if ($_POST['type'] !== JANITOR && $_POST['type'] !== MOD && $_POST['type'] !== ADMIN)
 			error(sprintf($config['error']['invalidfield'], 'type'));
 		
-		$query = prepare('INSERT INTO `mods` VALUES (NULL, :username, SHA1(:password), :type, :boards)');
+		$salt = generate_salt();
+		$password = hash('sha256', $salt . sha1($_POST['password']));
+		
+		$query = prepare('INSERT INTO `mods` VALUES (NULL, :username, :password, :salt, :type, :boards)');
 		$query->bindValue(':username', $_POST['username']);
-		$query->bindValue(':password', $_POST['password']);
+		$query->bindValue(':password', $password);
+		$query->bindValue(':salt', $salt);
 		$query->bindValue(':type', $_POST['type']);
 		$query->bindValue(':boards', implode(',', $boards));
 		$query->execute() or error(db_error($query));
-- 
cgit v1.3


From 33a1c00bd51618a4b54fd6fdab721aaaa03bfd33 Mon Sep 17 00:00:00 2001
From: Michael Foster <savetheinternet@tinyboard.org>
Date: Wed, 24 Jul 2013 11:30:01 -0400
Subject: %length% in public ban messages

---
 inc/config.php    | 4 +++-
 inc/mod/pages.php | 3 +++
 2 files changed, 6 insertions(+), 1 deletion(-)

(limited to 'inc/mod/pages.php')

diff --git a/inc/config.php b/inc/config.php
index b32f4266..98e127b3 100644
--- a/inc/config.php
+++ b/inc/config.php
@@ -879,8 +879,10 @@
 	
 	// Check public ban message by default
 	$config['mod']['check_ban_message'] = false;
-	// Default public ban message
+	// Default public ban message.
+	// In public ban messages, %length% is replaced with "for x days" or "permanently" (with %LENGTH% being the uppercase equivalent).
 	$config['mod']['default_ban_message'] = 'USER WAS BANNED FOR THIS POST';
+	// $config['mod']['default_ban_message'] = 'USER WAS BANNED %LENGTH% FOR THIS POST'; // Include length in ban message
 	// What to append to the post for public bans ("%s" is the message)
 	$config['mod']['ban_message'] = '<span class="public_ban">(%s)</span>';
 	
diff --git a/inc/mod/pages.php b/inc/mod/pages.php
index 1ed9a94b..01794d2e 100644
--- a/inc/mod/pages.php
+++ b/inc/mod/pages.php
@@ -1152,6 +1152,9 @@ function mod_ban_post($board, $delete, $post, $token = false) {
 		
 		if (isset($_POST['public_message'], $_POST['message'])) {
 			// public ban message
+			$length_english = parse_time($_POST['length']) ? 'for ' . until(parse_time($_POST['length'])) : 'permanently';
+			$_POST['message'] = str_replace('%length%', $length_english, $_POST['message']);
+			$_POST['message'] = str_replace('%LENGTH%', strtoupper($length_english), $_POST['message']);
 			$query = prepare(sprintf('UPDATE `posts_%s` SET `body` = CONCAT(`body`, :body) WHERE `id` = :id', $board));
 			$query->bindValue(':id', $post);
 			$query->bindValue(':body', sprintf($config['mod']['ban_message'], utf8tohtml($_POST['message'])));
-- 
cgit v1.3