webinterface.git

@@ -30,6 +30,22 @@ function gen_pw_hash($password)

     return $pwhash;

 }

+

+function legacy_pw_verify($password, $hash)

+{

+    /* Supports legacy SHA1/SHA256 hashes without salt,

+       for new use cases use password_verify() instead */

+    if ($hash[0] == '$') {

+        return password_verify($password, $hash);

+    } elseif (strlen($hash) == 40) {

+        return hash_equals(sha1($password), $hash);

+    } elseif (strlen($hash) == 64) {

+        return hash_equals(hash("sha256", $password), $hash);

+    }

+    return false;

+}

+

+

 function strong_password($password, $user = [])

 {

     $pwcheck = config('pwcheck');

@@ -104,7 +104,7 @@ function new_subuser($username, $requested_modules, $password)

     $args = [":uid" => $_SESSION['userinfo']['uid'],

                 ":username" => $username,

-                ":password" => hash("sha256", $password),

+                ":password" => gen_pw_hash($password),

                 ":modules" => implode(',', $modules), ];

     db_query("INSERT INTO system.subusers (uid, username, password, modules) VALUES (:uid, :username, :password, :modules)", $args);

@@ -159,7 +159,7 @@ function edit_subuser($id, $username, $requested_modules, $password)

         if ($result !== true) {

             system_failure("Unsicheres Passwort: " . $result);

         }

-        $args[':password'] = hash("sha256", $password);

+        $args[':password'] = gen_pw_hash($password);

         $pwchange = ", password=:password";

     }

@@ -86,8 +86,7 @@ function find_role($login, $password, $i_am_admin = false)

     if (@$result->rowCount() > 0) {

         $entry = $result->fetch(PDO::FETCH_OBJ);

         $db_password = $entry->password;

-        // SHA1 für alte Subuser (kaylee), SHA256 für neue Subuser

-        if (hash("sha1", $password) == $db_password || hash("sha256", $password) == $db_password || $i_am_admin) {

+        if (legacy_pw_verify($password, $db_password) || $i_am_admin) {

             logger(LOG_INFO, "session/checkuser", "login", "logged in virtual subuser »{$login}«.");

             return ROLE_SUBUSER;

         }

@@ -249,7 +248,7 @@ function set_subuser_password($subuser, $newpass)

 {

     $args = [":subuser" => $subuser,

                 ":uid" => (int) $_SESSION['userinfo']['uid'],

-                ":newpass" => sha1($newpass), ];

+                ":newpass" => gen_pw_hash($newpass), ];

     db_query("UPDATE system.subusers SET password=:newpass WHERE username=:subuser AND uid=:uid", $args);

     logger(LOG_INFO, "session/checkuser", "pwchange", "changed subuser's password.");

 }