From 6a2e0a4ea2a007ca4adc89b54f79002e827c0fd7 Mon Sep 17 00:00:00 2001 From: Srikanth Dhondi Date: Tue, 19 Feb 2013 14:03:49 +1300 Subject: [PATCH] [SIGNED-OFF] Bug 9611 - Changing the OPAC password hashing algorithm from MD5 to Bcrypt Signed-off-by: Bernardo Gonzalez Kriegel Comment: Work as described. No errors Test: 1) Old user with old pass can change password, new format 2) New user with new pass can change password 3) Old and new user with self-updated pass can login --- opac/opac-passwd.pl | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/opac/opac-passwd.pl b/opac/opac-passwd.pl index 19425f7..923a5cf 100755 --- a/opac/opac-passwd.pl +++ b/opac/opac-passwd.pl @@ -29,6 +29,7 @@ use Digest::MD5 qw(md5_base64); use C4::Circulation; use C4::Members; use C4::Output; +use C4::Auth qw(hash_password); my $query = new CGI; my $dbh = C4::Context->dbh; @@ -57,7 +58,7 @@ if ( C4::Context->preference("OpacPasswordChange") ) { if ( $query->param('Newkey') eq $query->param('Confirm') && length( $query->param('Confirm') ) >= $minpasslen ) { # Record password - my $clave = md5_base64( $query->param('Newkey') ); + my $clave = hash_password( $query->param('Newkey') ); $sth->execute( $clave, $borrowernumber ); $template->param( 'password_updated' => '1' ); $template->param( 'borrowernumber' => $borrowernumber ); @@ -113,8 +114,14 @@ sub goodkey { $dbh->prepare("SELECT password FROM borrowers WHERE borrowernumber=?"); $sth->execute($borrowernumber); if ( $sth->rows ) { - my ($md5password) = $sth->fetchrow; - if ( md5_base64($key) eq $md5password ) { return 1; } + my $hash; + my ($stored_hash) = $sth->fetchrow; + if ( substr($stored_hash,0,2) eq '$2') { + $hash = hash_password($key, $stored_hash); + } else { + $hash = md5_base64($key); + } + if ( $hash eq $stored_hash ) { return 1; } else { return 0; } } else { return 0; } -- 1.7.9.5