From dd5e4ce033ee2eb0592e5c99b0cac8fcb95503e4 Mon Sep 17 00:00:00 2001 From: Srikanth Dhondi Date: Tue, 19 Feb 2013 14:03:49 +1300 Subject: [PATCH] Bug 9611 - Changing the OPAC password hashing algorithm from MD5 to Bcrypt Content-Type: text/plain; charset="utf-8" http://koha-community.org Signed-off-by: Bernardo Gonzalez Kriegel Comment: Work as described. No errors Test: 1) Old user with old pass can change password, new format 2) New user with new pass can change password 3) Old and new user with self-updated pass can login Signed-off-by: Mason James --- opac/opac-passwd.pl | 13 ++++++++++--- 1 files changed, 10 insertions(+), 3 deletions(-) diff --git a/opac/opac-passwd.pl b/opac/opac-passwd.pl index 19425f7..923a5cf 100755 --- a/opac/opac-passwd.pl +++ b/opac/opac-passwd.pl @@ -29,6 +29,7 @@ use Digest::MD5 qw(md5_base64); use C4::Circulation; use C4::Members; use C4::Output; +use C4::Auth qw(hash_password); my $query = new CGI; my $dbh = C4::Context->dbh; @@ -57,7 +58,7 @@ if ( C4::Context->preference("OpacPasswordChange") ) { if ( $query->param('Newkey') eq $query->param('Confirm') && length( $query->param('Confirm') ) >= $minpasslen ) { # Record password - my $clave = md5_base64( $query->param('Newkey') ); + my $clave = hash_password( $query->param('Newkey') ); $sth->execute( $clave, $borrowernumber ); $template->param( 'password_updated' => '1' ); $template->param( 'borrowernumber' => $borrowernumber ); @@ -113,8 +114,14 @@ sub goodkey { $dbh->prepare("SELECT password FROM borrowers WHERE borrowernumber=?"); $sth->execute($borrowernumber); if ( $sth->rows ) { - my ($md5password) = $sth->fetchrow; - if ( md5_base64($key) eq $md5password ) { return 1; } + my $hash; + my ($stored_hash) = $sth->fetchrow; + if ( substr($stored_hash,0,2) eq '$2') { + $hash = hash_password($key, $stored_hash); + } else { + $hash = md5_base64($key); + } + if ( $hash eq $stored_hash ) { return 1; } else { return 0; } } else { return 0; } -- 1.7.2.5