Bugzilla – Attachment 21770 Details for
Bug 9611
Changing the password hashing algorithm from MD5 to more secure Bcrypt
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
bug_9611: Extracted checkpw_internal() and checkpw_hash() from checkpw()
bug9611-Extracted-checkpwinternal-and-checkpwhash-.patch (text/plain), 4.17 KB, created by
Katrin Fischer
on 2013-10-03 14:21:44 UTC
(
hide
)
Description:
bug_9611: Extracted checkpw_internal() and checkpw_hash() from checkpw()
Filename:
MIME Type:
Creator:
Katrin Fischer
Created:
2013-10-03 14:21:44 UTC
Size:
4.17 KB
patch
obsolete
>From 8b98a4c76371eb21acd0b21f54711451b4dafd50 Mon Sep 17 00:00:00 2001 >From: Srdjan <srdjan@catalyst.net.nz> >Date: Mon, 26 Aug 2013 16:29:10 +1200 >Subject: [PATCH] bug_9611: Extracted checkpw_internal() and checkpw_hash() > from checkpw() > >Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com> >--- > C4/Auth.pm | 50 ++++++++++++++++++++++++++++---------------------- > 1 file changed, 28 insertions(+), 22 deletions(-) > >diff --git a/C4/Auth.pm b/C4/Auth.pm >index 7674691..829f26a 100644 >--- a/C4/Auth.pm >+++ b/C4/Auth.pm >@@ -48,7 +48,8 @@ BEGIN { > $debug = $ENV{DEBUG}; > @ISA = qw(Exporter); > @EXPORT = qw(&checkauth &get_template_and_user &haspermission &get_user_subpermissions); >- @EXPORT_OK = qw(&check_api_auth &get_session &check_cookie_auth &checkpw &get_all_subpermissions &get_user_subpermissions >+ @EXPORT_OK = qw(&check_api_auth &get_session &check_cookie_auth &checkpw &checkpw_internal &checkpw_hash >+ &get_all_subpermissions &get_user_subpermissions > ParseSearchHistoryCookie hash_password > ); > %EXPORT_TAGS = ( EditPermissions => [qw(get_all_subpermissions get_user_subpermissions)] ); >@@ -1552,8 +1553,8 @@ sub generate_salt { > > > sub checkpw { >- > my ( $dbh, $userid, $password, $query ) = @_; >+ > if ($ldap) { > $debug and print STDERR "## checkpw - checking LDAP\n"; > my ($retval,$retcard,$retuserid) = checkpw_ldap(@_); # EXTERNAL AUTH >@@ -1563,13 +1564,18 @@ sub checkpw { > if ($cas && $query && $query->param('ticket')) { > $debug and print STDERR "## checkpw - checking CAS\n"; > # In case of a CAS authentication, we use the ticket instead of the password >- my $ticket = $query->param('ticket'); >+ my $ticket = $query->param('ticket'); > my ($retval,$retcard,$retuserid) = checkpw_cas($dbh, $ticket, $query); # EXTERNAL AUTH > ($retval) and return ($retval,$retcard,$retuserid); >- return 0; >+ return 0; > } > >- # INTERNAL AUTH >+ return checkpw_internal(@_) >+} >+ >+sub checkpw_internal { >+ my ( $dbh, $userid, $password ) = @_; >+ > my $sth = > $dbh->prepare( > "select password,cardnumber,borrowernumber,userid,firstname,surname,branchcode,flags from borrowers where userid=?" >@@ -1580,14 +1586,7 @@ sub checkpw { > $surname, $branchcode, $flags ) > = $sth->fetchrow; > >- # check what encryption algorithm was implemented: Bcrypt - if the hash starts with '$2' it is Bcrypt else md5 >- my $hash; >- if ( substr($stored_hash,0,2) eq '$2') { >- $hash = hash_password($password, $stored_hash); >- } else { >- $hash = md5_base64($password); >- } >- if ( $hash eq $stored_hash and $stored_hash ne "!") { >+ if ( checkpw_hash($password, $stored_hash) ) { > > C4::Context->set_userenv( "$borrowernumber", $userid, $cardnumber, > $firstname, $surname, $branchcode, $flags ); >@@ -1604,15 +1603,7 @@ sub checkpw { > $surname, $branchcode, $flags ) > = $sth->fetchrow; > >- # check what encryption algorithm was implemented: Bcrypt - if the hash starts with '$2' it is Bcrypt else md5 >- my $hash; >- if ( substr($stored_hash,0,2) eq '$2') { >- $hash = hash_password($password, $stored_hash); >- } else { >- $hash = md5_base64($password); >- } >- >- if ( $hash eq $stored_hash ) { >+ if ( checkpw_hash($password, $stored_hash) ) { > > C4::Context->set_userenv( $borrowernumber, $userid, $cardnumber, > $firstname, $surname, $branchcode, $flags ); >@@ -1639,6 +1630,21 @@ sub checkpw { > return 0; > } > >+sub checkpw_hash { >+ my ( $password, $stored_hash ) = @_; >+ >+ return if $stored_hash eq '!'; >+ >+ # check what encryption algorithm was implemented: Bcrypt - if the hash starts with '$2' it is Bcrypt else md5 >+ my $hash; >+ if ( substr($stored_hash,0,2) eq '$2') { >+ $hash = hash_password($password, $stored_hash); >+ } else { >+ $hash = md5_base64($password); >+ } >+ return $hash eq $stored_hash; >+} >+ > =head2 getuserflags > > my $authflags = getuserflags($flags, $userid, [$dbh]); >-- >1.7.9.5
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 9611
:
15311
|
15427
|
15428
|
15429
|
15505
|
15506
|
15507
|
15508
|
15509
|
15510
|
15514
|
15515
|
15516
|
15517
|
15518
|
15519
|
15520
|
15521
|
15522
|
17203
|
17204
|
20252
|
20253
|
20254
|
20255
|
20576
|
20577
|
20578
|
20621
|
20622
|
20623
|
20624
|
21614
|
21615
|
21621
|
21622
|
21623
|
21624
|
21625
|
21626
|
21627
|
21628
|
21767
|
21768
|
21769
|
21770
|
21771
|
21772
|
21775
|
21776
|
21777
|
21789
|
21790
|
21791
|
21792
|
21793
|
21794
|
21795
|
21796