Bugzilla – Attachment 15509 Details for
Bug 9611
Changing the password hashing algorithm from MD5 to more secure Bcrypt
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
[SIGNED-OFF] Bug 9611 - Changing the OPAC password hashing algorithm from MD5 to Bcrypt
SIGNED-OFF-Bug-9611---Changing-the-OPAC-password-h.patch (text/plain), 2.14 KB, created by
Bernardo Gonzalez Kriegel
on 2013-02-19 03:12:43 UTC
(
hide
)
Description:
[SIGNED-OFF] Bug 9611 - Changing the OPAC password hashing algorithm from MD5 to Bcrypt
Filename:
MIME Type:
Creator:
Bernardo Gonzalez Kriegel
Created:
2013-02-19 03:12:43 UTC
Size:
2.14 KB
patch
obsolete
>From 6a2e0a4ea2a007ca4adc89b54f79002e827c0fd7 Mon Sep 17 00:00:00 2001 >From: Srikanth Dhondi <srikanth@catalyst.net.nz> >Date: Tue, 19 Feb 2013 14:03:49 +1300 >Subject: [PATCH] [SIGNED-OFF] Bug 9611 - Changing the OPAC password hashing > algorithm from MD5 to Bcrypt > >Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com> > >Comment: Work as described. No errors > >Test: >1) Old user with old pass can change password, new format >2) New user with new pass can change password >3) Old and new user with self-updated pass can login >--- > opac/opac-passwd.pl | 13 ++++++++++--- > 1 file changed, 10 insertions(+), 3 deletions(-) > >diff --git a/opac/opac-passwd.pl b/opac/opac-passwd.pl >index 19425f7..923a5cf 100755 >--- a/opac/opac-passwd.pl >+++ b/opac/opac-passwd.pl >@@ -29,6 +29,7 @@ use Digest::MD5 qw(md5_base64); > use C4::Circulation; > use C4::Members; > use C4::Output; >+use C4::Auth qw(hash_password); > > my $query = new CGI; > my $dbh = C4::Context->dbh; >@@ -57,7 +58,7 @@ if ( C4::Context->preference("OpacPasswordChange") ) { > if ( $query->param('Newkey') eq $query->param('Confirm') > && length( $query->param('Confirm') ) >= $minpasslen ) > { # Record password >- my $clave = md5_base64( $query->param('Newkey') ); >+ my $clave = hash_password( $query->param('Newkey') ); > $sth->execute( $clave, $borrowernumber ); > $template->param( 'password_updated' => '1' ); > $template->param( 'borrowernumber' => $borrowernumber ); >@@ -113,8 +114,14 @@ sub goodkey { > $dbh->prepare("SELECT password FROM borrowers WHERE borrowernumber=?"); > $sth->execute($borrowernumber); > if ( $sth->rows ) { >- my ($md5password) = $sth->fetchrow; >- if ( md5_base64($key) eq $md5password ) { return 1; } >+ my $hash; >+ my ($stored_hash) = $sth->fetchrow; >+ if ( substr($stored_hash,0,2) eq '$2') { >+ $hash = hash_password($key, $stored_hash); >+ } else { >+ $hash = md5_base64($key); >+ } >+ if ( $hash eq $stored_hash ) { return 1; } > else { return 0; } > } > else { return 0; } >-- >1.7.9.5
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 9611
:
15311
|
15427
|
15428
|
15429
|
15505
|
15506
|
15507
|
15508
|
15509
|
15510
|
15514
|
15515
|
15516
|
15517
|
15518
|
15519
|
15520
|
15521
|
15522
|
17203
|
17204
|
20252
|
20253
|
20254
|
20255
|
20576
|
20577
|
20578
|
20621
|
20622
|
20623
|
20624
|
21614
|
21615
|
21621
|
21622
|
21623
|
21624
|
21625
|
21626
|
21627
|
21628
|
21767
|
21768
|
21769
|
21770
|
21771
|
21772
|
21775
|
21776
|
21777
|
21789
|
21790
|
21791
|
21792
|
21793
|
21794
|
21795
|
21796