Bugzilla – Attachment 20624 Details for
Bug 9611
Changing the password hashing algorithm from MD5 to more secure Bcrypt
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
bug_9611: use hash_password() and checkpw_* instead of md5 hash
bug9611-use-hashpassword-and-checkpw-instead-of-md.patch (text/plain), 3.96 KB, created by
Srdjan Jankovic
on 2013-08-26 06:50:45 UTC
(
hide
)
Description:
bug_9611: use hash_password() and checkpw_* instead of md5 hash
Filename:
MIME Type:
Creator:
Srdjan Jankovic
Created:
2013-08-26 06:50:45 UTC
Size:
3.96 KB
patch
obsolete
>From cb6649596505668ac4d4be67b90b33b88bb27aa7 Mon Sep 17 00:00:00 2001 >From: Srdjan <srdjan@catalyst.net.nz> >Date: Fri, 23 Aug 2013 20:02:53 +1200 >Subject: [PATCH] bug_9611: use hash_password() and checkpw_* instead of md5 > hash > >Test: > >* LDAP: >- Turn on LDAP auth in koha-config.xml. Sset "update" in your server config to 1 >- Change user's password on LDAP >- Login to Koha using LDAP - Koha password should be updated, to check >- Turn off LDAP auth in koha-config.xml >- You should be ble to log in with the new password > >I do not have a LDAP facility, so I cheated. I ran >perl -e 'use C4::Auth_with_ldap; C4::Auth_with_ldap::_do_changepassword("srdjan", 1000022259, "srdjan");' >and was able to change the password. >--- > C4/Auth_with_ldap.pm | 64 ++++++++++++++++++++++++++-------------------------- > 1 file changed, 32 insertions(+), 32 deletions(-) > >diff --git a/C4/Auth_with_ldap.pm b/C4/Auth_with_ldap.pm >index 6143c9f..49ffc70 100644 >--- a/C4/Auth_with_ldap.pm >+++ b/C4/Auth_with_ldap.pm >@@ -19,7 +19,7 @@ package C4::Auth_with_ldap; > > use strict; > #use warnings; FIXME - Bug 2505 >-use Digest::MD5 qw(md5_base64); >+use Carp; > > use C4::Debug; > use C4::Context; >@@ -27,6 +27,7 @@ use C4::Members qw(AddMember changepassword); > use C4::Members::Attributes; > use C4::Members::AttributeTypes; > use C4::Utils qw( :all ); >+use C4::Auth qw(hash_password checkpw_internal); > use List::MoreUtils qw( any ); > use Net::LDAP; > use Net::LDAP::Filter; >@@ -264,44 +265,43 @@ sub exists_local { > } > > sub _do_changepassword { >- my ($userid, $borrowerid, $digest) = @_; >+ my ($userid, $borrowerid, $password) = @_; >+ >+ my $digest = hash_password($password); >+ > $debug and print STDERR "changing local password for borrowernumber=$borrowerid to '$digest'\n"; > changepassword($userid, $borrowerid, $digest); > >- # Confirm changes >- my $sth = C4::Context->dbh->prepare("SELECT password,cardnumber FROM borrowers WHERE borrowernumber=? "); >- $sth->execute($borrowerid); >- if ($sth->rows) { >- my ($md5password, $cardnum) = $sth->fetchrow; >- ($digest eq $md5password) and return $cardnum; >- warn "Password mismatch after update to cardnumber=$cardnum (borrowernumber=$borrowerid)"; >- return; >- } >- die "Unexpected error after password update to userid/borrowernumber: $userid / $borrowerid."; >+ my ($ok, $cardnum) = checkpw_internal(C4::Context->dbh, $userid, $password); >+ return $cardnum if $ok; >+ >+ warn "Password mismatch after update to borrowernumber=$borrowerid"; >+ return; > } > > sub update_local { >- my $userid = shift or return; >- my $digest = md5_base64(shift) or return; >- my $borrowerid = shift or return; >- my $borrower = shift or return; >- my @keys = keys %$borrower; >- my $dbh = C4::Context->dbh; >- my $query = "UPDATE borrowers\nSET " . >- join(',', map {"$_=?"} @keys) . >- "\nWHERE borrowernumber=? "; >- my $sth = $dbh->prepare($query); >- if ($debug) { >- print STDERR $query, "\n", >- join "\n", map {"$_ = '" . $borrower->{$_} . "'"} @keys; >- print STDERR "\nuserid = $userid\n"; >- } >- $sth->execute( >- ((map {$borrower->{$_}} @keys), $borrowerid) >- ); >+ my $userid = shift or croak "No userid"; >+ my $password = shift or croak "No password"; >+ my $borrowerid = shift or croak "No borrowerid"; >+ my $borrower = shift or croak "No borrower record"; >+ >+ my @keys = keys %$borrower; >+ my $dbh = C4::Context->dbh; >+ my $query = "UPDATE borrowers\nSET " . >+ join(',', map {"$_=?"} @keys) . >+ "\nWHERE borrowernumber=? "; >+ my $sth = $dbh->prepare($query); >+ if ($debug) { >+ print STDERR $query, "\n", >+ join "\n", map {"$_ = '" . $borrower->{$_} . "'"} @keys; >+ print STDERR "\nuserid = $userid\n"; >+ } >+ $sth->execute( >+ ((map {$borrower->{$_}} @keys), $borrowerid) >+ ); > >- # MODIFY PASSWORD/LOGIN >- _do_changepassword($userid, $borrowerid, $digest); >+ # MODIFY PASSWORD/LOGIN >+ _do_changepassword($userid, $borrowerid, $password); > } > > 1; >-- >1.8.1.2
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 9611
:
15311
|
15427
|
15428
|
15429
|
15505
|
15506
|
15507
|
15508
|
15509
|
15510
|
15514
|
15515
|
15516
|
15517
|
15518
|
15519
|
15520
|
15521
|
15522
|
17203
|
17204
|
20252
|
20253
|
20254
|
20255
|
20576
|
20577
|
20578
|
20621
|
20622
|
20623
|
20624
|
21614
|
21615
|
21621
|
21622
|
21623
|
21624
|
21625
|
21626
|
21627
|
21628
|
21767
|
21768
|
21769
|
21770
|
21771
|
21772
|
21775
|
21776
|
21777
|
21789
|
21790
|
21791
|
21792
|
21793
|
21794
|
21795
|
21796