Bugzilla – Attachment 15521 Details for
Bug 9611
Changing the password hashing algorithm from MD5 to more secure Bcrypt
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 9611 - Changing the OPAC password hashing algorithm from MD5 to Bcrypt
Bug-9611---Changing-the-OPAC-password-hashing-algo.patch (text/plain), 2.24 KB, created by
Mason James
on 2013-02-19 04:37:07 UTC
(
hide
)
Description:
Bug 9611 - Changing the OPAC password hashing algorithm from MD5 to Bcrypt
Filename:
MIME Type:
Creator:
Mason James
Created:
2013-02-19 04:37:07 UTC
Size:
2.24 KB
patch
obsolete
>From dd5e4ce033ee2eb0592e5c99b0cac8fcb95503e4 Mon Sep 17 00:00:00 2001 >From: Srikanth Dhondi <srikanth@catalyst.net.nz> >Date: Tue, 19 Feb 2013 14:03:49 +1300 >Subject: [PATCH] Bug 9611 - Changing the OPAC password hashing algorithm from MD5 to Bcrypt >Content-Type: text/plain; charset="utf-8" >http://koha-community.org > >Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com> > >Comment: Work as described. No errors > >Test: >1) Old user with old pass can change password, new format >2) New user with new pass can change password >3) Old and new user with self-updated pass can login >Signed-off-by: Mason James <mtj@kohaaloha.com> >--- > opac/opac-passwd.pl | 13 ++++++++++--- > 1 files changed, 10 insertions(+), 3 deletions(-) > >diff --git a/opac/opac-passwd.pl b/opac/opac-passwd.pl >index 19425f7..923a5cf 100755 >--- a/opac/opac-passwd.pl >+++ b/opac/opac-passwd.pl >@@ -29,6 +29,7 @@ use Digest::MD5 qw(md5_base64); > use C4::Circulation; > use C4::Members; > use C4::Output; >+use C4::Auth qw(hash_password); > > my $query = new CGI; > my $dbh = C4::Context->dbh; >@@ -57,7 +58,7 @@ if ( C4::Context->preference("OpacPasswordChange") ) { > if ( $query->param('Newkey') eq $query->param('Confirm') > && length( $query->param('Confirm') ) >= $minpasslen ) > { # Record password >- my $clave = md5_base64( $query->param('Newkey') ); >+ my $clave = hash_password( $query->param('Newkey') ); > $sth->execute( $clave, $borrowernumber ); > $template->param( 'password_updated' => '1' ); > $template->param( 'borrowernumber' => $borrowernumber ); >@@ -113,8 +114,14 @@ sub goodkey { > $dbh->prepare("SELECT password FROM borrowers WHERE borrowernumber=?"); > $sth->execute($borrowernumber); > if ( $sth->rows ) { >- my ($md5password) = $sth->fetchrow; >- if ( md5_base64($key) eq $md5password ) { return 1; } >+ my $hash; >+ my ($stored_hash) = $sth->fetchrow; >+ if ( substr($stored_hash,0,2) eq '$2') { >+ $hash = hash_password($key, $stored_hash); >+ } else { >+ $hash = md5_base64($key); >+ } >+ if ( $hash eq $stored_hash ) { return 1; } > else { return 0; } > } > else { return 0; } >-- >1.7.2.5
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 9611
:
15311
|
15427
|
15428
|
15429
|
15505
|
15506
|
15507
|
15508
|
15509
|
15510
|
15514
|
15515
|
15516
|
15517
|
15518
|
15519
|
15520
|
15521
|
15522
|
17203
|
17204
|
20252
|
20253
|
20254
|
20255
|
20576
|
20577
|
20578
|
20621
|
20622
|
20623
|
20624
|
21614
|
21615
|
21621
|
21622
|
21623
|
21624
|
21625
|
21626
|
21627
|
21628
|
21767
|
21768
|
21769
|
21770
|
21771
|
21772
|
21775
|
21776
|
21777
|
21789
|
21790
|
21791
|
21792
|
21793
|
21794
|
21795
|
21796