Bugzilla – Attachment 21794 Details for
Bug 9611
Changing the password hashing algorithm from MD5 to more secure Bcrypt
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
bug_9611: use checkpw_hash() instead of md5 hash
bug9611-use-checkpwhash-instead-of-md5-hash.patch (text/plain), 2.49 KB, created by
Kyle M Hall (khall)
on 2013-10-03 16:49:23 UTC
(
hide
)
Description:
bug_9611: use checkpw_hash() instead of md5 hash
Filename:
MIME Type:
Creator:
Kyle M Hall (khall)
Created:
2013-10-03 16:49:23 UTC
Size:
2.49 KB
patch
obsolete
>From 2bd5c7dfe2050f0a33ddb69b08e7215c910a4703 Mon Sep 17 00:00:00 2001 >From: Srdjan <srdjan@catalyst.net.nz> >Date: Mon, 26 Aug 2013 17:01:20 +1200 >Subject: [PATCH] bug_9611: use checkpw_hash() instead of md5 hash > >Test: > >* SIP: Have an old user and create a new user >- use either tenet sip test or > C4/SIP/interactive_patron_check_password.pl to check old > userid/password >- do the same for the new user > >Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com> >Work as described > >Test >1) using perl C4/SIP/interactive_patron_check_password.pl >can check current (short) and new (long) passwords > >Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> >--- > C4/SIP/ILS/Patron.pm | 14 ++++++++------ > 1 files changed, 8 insertions(+), 6 deletions(-) > >diff --git a/C4/SIP/ILS/Patron.pm b/C4/SIP/ILS/Patron.pm >index b9f0659..1155d51 100644 >--- a/C4/SIP/ILS/Patron.pm >+++ b/C4/SIP/ILS/Patron.pm >@@ -21,8 +21,8 @@ use C4::Koha; > use C4::Members; > use C4::Reserves; > use C4::Branch qw(GetBranchName); >-use Digest::MD5 qw(md5_base64); > use C4::Items qw( GetBarcodeFromItemnumber GetItemnumbersForBiblio); >+use C4::Auth qw(checkpw_hash); > > our $VERSION = 3.07.00.049; > >@@ -40,7 +40,7 @@ sub new { > } > $kp = GetMemberDetails($kp->{borrowernumber}); > $debug and warn "new Patron (GetMemberDetails): " . Dumper($kp); >- my $pw = $kp->{password}; ### FIXME - md5hash -- deal with . >+ my $pw = $kp->{password}; > my $flags = $kp->{flags}; # or warn "Warning: No flags from patron object for '$patron_id'"; > my $debarred = defined($kp->{flags}->{DBARRED}); > $debug and warn sprintf("Debarred = %s : ", ($debarred||'undef')) . Dumper(%{$kp->{flags}}); >@@ -189,11 +189,13 @@ sub AUTOLOAD { > > sub check_password { > my ($self, $pwd) = @_; >- my $md5pwd = $self->{password}; >+ defined $pwd or return 0; # you gotta give me something (at least ''), or no deal >+ >+ my $hashed_pwd = $self->{password}; >+ defined $hashed_pwd or return $pwd eq ''; # if the record has a NULL password, accept '' as match >+ > # warn sprintf "check_password for %s: '%s' vs. '%s'",($self->{name}||''),($self->{password}||''),($pwd||''); >- (defined $pwd ) or return 0; # you gotta give me something (at least ''), or no deal >- (defined $md5pwd) or return($pwd eq ''); # if the record has a NULL password, accept '' as match >- return (md5_base64($pwd) eq $md5pwd); >+ return checkpw_hash($pwd, $hashed_pwd); > } > > # A few special cases, not in AUTOLOADed %fields >-- >1.7.2.5
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 9611
:
15311
|
15427
|
15428
|
15429
|
15505
|
15506
|
15507
|
15508
|
15509
|
15510
|
15514
|
15515
|
15516
|
15517
|
15518
|
15519
|
15520
|
15521
|
15522
|
17203
|
17204
|
20252
|
20253
|
20254
|
20255
|
20576
|
20577
|
20578
|
20621
|
20622
|
20623
|
20624
|
21614
|
21615
|
21621
|
21622
|
21623
|
21624
|
21625
|
21626
|
21627
|
21628
|
21767
|
21768
|
21769
|
21770
|
21771
|
21772
|
21775
|
21776
|
21777
|
21789
|
21790
|
21791
|
21792
|
21793
| 21794 |
21795
|
21796