CW Cyrix's Git Repository Mirror
Browse code

Password authentication changed from ancient MD5 to bcrypt for PHP 5.5 and above, and crypt for PHP versions 5.0 to 5.4.x. Will be more precise later.

Clarissa Walker authored on 2015/09/14 06:58:30
Showing 3 changed files
editconfig.php
History View file @ 0d35e71
... ... 
@@ -138,7 +138,7 @@ if (!isset($_POST["saveconfig"]))
138 138 
 	Again, this user is only able to create, and not delete torrents to the tracker.
139 139 
 	For full privileges, see the admin user.<br><br>
140 140 
 	<input type="hidden" name="old_upload_password" value="<?php echo $temp;?>">
141 
-	<b>Current MD5 hashed username+password: <?php echo $temp;?></b></td>
141 
+	<b>Current hashed username+password: <?php echo $temp;?></b></td>
142 142 
 	<td><input type="password" name="upload_password" size="40" value=""></td></tr>
143 143 
 	<?php
144 144 
 	$temp = fgets($fr);
... ... 
@@ -157,7 +157,7 @@ if (!isset($_POST["saveconfig"]))
157 157 
 	information about the tracker as well as access a few other important tools.
158 158 
 	The admin is also able to upload torrents to the database.<br><br>
159 159 
 	<input type="hidden" name="old_admin_password" value="<?php echo $temp;?>">
160 
-	<b>Current MD5 hashed username+password: <?php echo $temp;?></b></td>
160 
+	<b>Current hashed username+password: <?php echo $temp;?></b></td>
161 161 
 	<td><input type="password" name="admin_password" size="40" value=""></td></tr>
162 162 
 	<?php
163 163 
 	$temp = fgets($fr);
... ... 
@@ -462,19 +462,39 @@ if (isset($_POST["saveconfig"]))
462 462 
 		exit();
463 463 
 	}
464 464
465 
-	//calculate new MD5 password if needed
466 
-	if ($_POST["upload_password"] != "")
465 
+	//calculate new password if needed
466 
+	$_GET['php_version'] = PHP_VERSION;
467 
+	if (version_compare(PHP_VERSION, '5.5.0*', '>='))
467 468 
 	{
468 
-		$_POST["upload_password"] = md5($_POST["upload_username"].$_POST["upload_password"]);
469 
+		if ($_POST["upload_password"] != "")
470 
+		{
471 
+			$_POST["upload_password"] = password_hash($_POST["upload_username"].$_POST["upload_password"], PASSWORD_BCRYPT);
472 
+		}
473 
+		else
474 
+			$_POST["upload_password"] = $_POST["old_upload_password"];
475 
+		if ($_POST["admin_password"] != "")
476 
+		{
477 
+			$_POST["admin_password"] = password_hash($_POST["admin_username"].$_POST["admin_password"], PASSWORD_BCRYPT);
478 
+		}
479 
+		else
480 
+			$_POST["admin_password"] = $_POST["old_admin_password"];
469 481 
 	}
470 
-	else
471 
-		$_POST["upload_password"] = $_POST["old_upload_password"];
472 
-	if ($_POST["admin_password"] != "")
482 
+
483 
+	else if (version_compare(PHP_VERSION, '5.4.0*', '<='))
473 484 
 	{
474 
-		$_POST["admin_password"] = md5($_POST["admin_username"].$_POST["admin_password"]);
485 
+		if ($_POST["upload_password"] != "")
486 
+		{
487 
+			$_POST["upload_password"] = crypt($_POST["upload_username"].$_POST["upload_password"]);
488 
+		}
489 
+		else
490 
+			$_POST["upload_password"] = $_POST["old_upload_password"];
491 
+		if ($_POST["admin_password"] != "")
492 
+		{
493 
+			$_POST["admin_password"] = crypt($_POST["admin_username"].$_POST["admin_password"]);
494 
+		}
495 
+		else
496 
+			$_POST["admin_password"] = $_POST["old_admin_password"];
475 497 
 	}
476 
-	else
477 
-		$_POST["admin_password"] = $_POST["old_admin_password"];
478 498
479 499 
 	//check if config.php has write access
480 500 
 	if (is_writable("config.php"))
install.php
History View file @ 0d35e71
... ... 
@@ -704,102 +704,208 @@ echo ("<br><br>");
704 704 
 			else
705 705 
 				$countbytes = "false";
706 706
707 
+			$_GET['php_version'] = PHP_VERSION;
708 
+
707 709 
 			//write config.php file
708 
-			$fd = fopen("config.php", "w") or die(errorMessage() . "Error: couldn't make config.php!</p>");
709 
-			fwrite($fd,
710 
-			"<?php //Please do NOT edit this file, use the admin page for changes.\n" .
711 
-			"\$GLOBALS['hiddentracker'] = " . $hiddentracker . ";\n" .
712 
-			"\$GLOBALS['scrape'] = " . $scrape . ";\n" .
713 
-			"\$GLOBALS['customtitle'] = " . $customtitle . ";\n" .
714 
-			"\$GLOBALS['indexpagelimitspecify'] = " . htmlspecialchars($_POST["indexpagelimitspecify"]) . ";\n" .
715 
-			"\$GLOBALS['statspagelimitspecify'] = " . htmlspecialchars($_POST["statspagelimitspecify"]) . ";\n" .
716 
-			"\$GLOBALS['report_interval'] = " . htmlspecialchars($_POST["report_interval"]) . ";\n" .
717 
-			"\$GLOBALS['min_interval'] = " . htmlspecialchars($_POST["min_interval"]) . ";\n" .
718 
-			"\$GLOBALS['maxpeers'] = " . htmlspecialchars($_POST["maxpeers"]) . ";\n" .
719 
-			"\$GLOBALS['NAT'] = " . $NAT . ";\n" .
720 
-			"\$GLOBALS['persist'] = " . $persist . ";\n" .
721 
-			"\$GLOBALS['ip_override'] = " . $ip_override . ";\n" .
722 
-			"\$GLOBALS['countbytes'] = " . $countbytes . ";\n" .
723 
-			"\$upload_username = '" . htmlspecialchars($_POST["upload_username"]) . "';\n" .
724 
-			"\$upload_password = '" . md5($_POST["upload_username"].$_POST["upload_password"]) . "';\n" .
725 
-			"\$admin_username = '" . htmlspecialchars($_POST["admin_username"]) . "';\n" .
726 
-			"\$admin_password = '" . md5($_POST["admin_username"].$_POST["admin_password"]) . "';\n" .
727 
-			"\$GLOBALS['title'] = '" . htmlspecialchars(addquotes($_POST["title"])) . "';\n" .
728 
-			"\$dbhost = '" . htmlspecialchars($_POST["dbhost"]) . "';\n" .
729 
-			"\$dbuser = '" . htmlspecialchars($_POST["dbuser"]) . "';\n" .
730 
-			"\$dbpass = '" . htmlspecialchars($_POST["dbpass"]) . "';\n" .
731 
-			"\$database = '" . htmlspecialchars($_POST["database"]) . "';\n" .
732 
-			"\$enablerss = " . $enablerss . ";\n" .
733 
-			"\$rss_title = '" . htmlspecialchars(addquotes($_POST["rss_title"])) . "';\n" .
734 
-			"\$rss_link = '" . htmlspecialchars($_POST["rss_link"]) . "';\n" .
735 
-			"\$rss_description = '" . htmlspecialchars(addquotes($_POST["rss_description"])) . "';\n" .
736 
-			"\$website_url = '" . htmlspecialchars($_POST["website_url"]) . "';\n" .
737 
-			"\$announce_url0 = '" . htmlspecialchars($_POST["announce_url0"]) . "';\n" .
738 
-			"\$announce_url1 = '" . htmlspecialchars($_POST["announce_url1"]) . "';\n" .
739 
-			"\$announce_url2 = '" . htmlspecialchars($_POST["announce_url2"]) . "';\n" .
740 
-			"\$announce_url3 = '" . htmlspecialchars($_POST["announce_url3"]) . "';\n" .
741 
-			"\$announce_url4 = '" . htmlspecialchars($_POST["announce_url4"]) . "';\n" .
742 
-			"\$GLOBALS['max_upload_rate'] = " . htmlspecialchars($_POST['max_upload_rate']) . ";\n" .
743 
-			"\$GLOBALS['max_uploads'] = " . htmlspecialchars($_POST['max_uploads']) . ";\n" .
744 
-			"\$dateformat = '" . htmlspecialchars($_POST["dateformat"]) . "';\n" .
745 
-			"\$timezone = '" . htmlspecialchars($_POST["timezone"]) . "';\n" .
746 
-			"\$prefix = '" . htmlspecialchars($_POST["prefix"]) . "';\n" .
747 
-			"?>"
748 
-			);
749 
-
750 
-			fclose($fd);
710 
+			if (version_compare(PHP_VERSION, '5.5.0*', '>=')) {
711 
+				$fd = fopen("config.php", "w") or die(errorMessage() . "Error: couldn't make config.php!</p>");
712 
+				fwrite($fd,
713 
+				"<?php //Please do NOT edit this file, use the admin page for changes.\n" .
714 
+				"\$GLOBALS['hiddentracker'] = " . $hiddentracker . ";\n" .
715 
+				"\$GLOBALS['scrape'] = " . $scrape . ";\n" .
716 
+				"\$GLOBALS['customtitle'] = " . $customtitle . ";\n" .
717 
+				"\$GLOBALS['indexpagelimitspecify'] = " . htmlspecialchars($_POST["indexpagelimitspecify"]) . ";\n" .
718 
+				"\$GLOBALS['statspagelimitspecify'] = " . htmlspecialchars($_POST["statspagelimitspecify"]) . ";\n" .
719 
+				"\$GLOBALS['report_interval'] = " . htmlspecialchars($_POST["report_interval"]) . ";\n" .
720 
+				"\$GLOBALS['min_interval'] = " . htmlspecialchars($_POST["min_interval"]) . ";\n" .
721 
+				"\$GLOBALS['maxpeers'] = " . htmlspecialchars($_POST["maxpeers"]) . ";\n" .
722 
+				"\$GLOBALS['NAT'] = " . $NAT . ";\n" .
723 
+				"\$GLOBALS['persist'] = " . $persist . ";\n" .
724 
+				"\$GLOBALS['ip_override'] = " . $ip_override . ";\n" .
725 
+				"\$GLOBALS['countbytes'] = " . $countbytes . ";\n" .
726 
+				"\$upload_username = '" . htmlspecialchars($_POST["upload_username"]) . "';\n" .
727 
+				"\$upload_password = '" . password_hash($_POST["upload_username"].$_POST["upload_password"], PASSWORD_BCRYPT) . "';\n" .
728 
+				"\$admin_username = '" . htmlspecialchars($_POST["admin_username"]) . "';\n" .
729 
+				"\$admin_password = '" . password_hash($_POST["admin_username"].$_POST["admin_password"], PASSWORD_BCRYPT) . "';\n" .
730 
+				"\$GLOBALS['title'] = '" . htmlspecialchars(addquotes($_POST["title"])) . "';\n" .
731 
+				"\$dbhost = '" . htmlspecialchars($_POST["dbhost"]) . "';\n" .
732 
+				"\$dbuser = '" . htmlspecialchars($_POST["dbuser"]) . "';\n" .
733 
+				"\$dbpass = '" . htmlspecialchars($_POST["dbpass"]) . "';\n" .
734 
+				"\$database = '" . htmlspecialchars($_POST["database"]) . "';\n" .
735 
+				"\$enablerss = " . $enablerss . ";\n" .
736 
+				"\$rss_title = '" . htmlspecialchars(addquotes($_POST["rss_title"])) . "';\n" .
737 
+				"\$rss_link = '" . htmlspecialchars($_POST["rss_link"]) . "';\n" .
738 
+				"\$rss_description = '" . htmlspecialchars(addquotes($_POST["rss_description"])) . "';\n" .
739 
+				"\$website_url = '" . htmlspecialchars($_POST["website_url"]) . "';\n" .
740 
+				"\$announce_url0 = '" . htmlspecialchars($_POST["announce_url0"]) . "';\n" .
741 
+				"\$announce_url1 = '" . htmlspecialchars($_POST["announce_url1"]) . "';\n" .
742 
+				"\$announce_url2 = '" . htmlspecialchars($_POST["announce_url2"]) . "';\n" .
743 
+				"\$announce_url3 = '" . htmlspecialchars($_POST["announce_url3"]) . "';\n" .
744 
+				"\$announce_url4 = '" . htmlspecialchars($_POST["announce_url4"]) . "';\n" .
745 
+				"\$GLOBALS['max_upload_rate'] = " . htmlspecialchars($_POST['max_upload_rate']) . ";\n" .
746 
+				"\$GLOBALS['max_uploads'] = " . htmlspecialchars($_POST['max_uploads']) . ";\n" .
747 
+				"\$dateformat = '" . htmlspecialchars($_POST["dateformat"]) . "';\n" .
748 
+				"\$timezone = '" . htmlspecialchars($_POST["timezone"]) . "';\n" .
749 
+				"\$prefix = '" . htmlspecialchars($_POST["prefix"]) . "';\n" .
750 
+				"?>"
751 
+				);
752 
+
753 
+				fclose($fd);
754 
+			}
755 
+
756 
+			else if (version_compare(PHP_VERSION, '5.4.0*', '<=')) {
757 
+				$fd = fopen("config.php", "w") or die(errorMessage() . "Error: couldn't make config.php!</p>");
758 
+				fwrite($fd,
759 
+				"<?php //Please do NOT edit this file, use the admin page for changes.\n" .
760 
+				"\$GLOBALS['hiddentracker'] = " . $hiddentracker . ";\n" .
761 
+				"\$GLOBALS['scrape'] = " . $scrape . ";\n" .
762 
+				"\$GLOBALS['customtitle'] = " . $customtitle . ";\n" .
763 
+				"\$GLOBALS['indexpagelimitspecify'] = " . htmlspecialchars($_POST["indexpagelimitspecify"]) . ";\n" .
764 
+				"\$GLOBALS['statspagelimitspecify'] = " . htmlspecialchars($_POST["statspagelimitspecify"]) . ";\n" .
765 
+				"\$GLOBALS['report_interval'] = " . htmlspecialchars($_POST["report_interval"]) . ";\n" .
766 
+				"\$GLOBALS['min_interval'] = " . htmlspecialchars($_POST["min_interval"]) . ";\n" .
767 
+				"\$GLOBALS['maxpeers'] = " . htmlspecialchars($_POST["maxpeers"]) . ";\n" .
768 
+				"\$GLOBALS['NAT'] = " . $NAT . ";\n" .
769 
+				"\$GLOBALS['persist'] = " . $persist . ";\n" .
770 
+				"\$GLOBALS['ip_override'] = " . $ip_override . ";\n" .
771 
+				"\$GLOBALS['countbytes'] = " . $countbytes . ";\n" .
772 
+				"\$upload_username = '" . htmlspecialchars($_POST["upload_username"]) . "';\n" .
773 
+				"\$upload_password = '" . crypt($_POST["upload_username"].$_POST["upload_password"]) . "';\n" .
774 
+				"\$admin_username = '" . htmlspecialchars($_POST["admin_username"]) . "';\n" .
775 
+				"\$admin_password = '" . crypt($_POST["admin_username"].$_POST["admin_password"]) . "';\n" .
776 
+				"\$GLOBALS['title'] = '" . htmlspecialchars(addquotes($_POST["title"])) . "';\n" .
777 
+				"\$dbhost = '" . htmlspecialchars($_POST["dbhost"]) . "';\n" .
778 
+				"\$dbuser = '" . htmlspecialchars($_POST["dbuser"]) . "';\n" .
779 
+				"\$dbpass = '" . htmlspecialchars($_POST["dbpass"]) . "';\n" .
780 
+				"\$database = '" . htmlspecialchars($_POST["database"]) . "';\n" .
781 
+				"\$enablerss = " . $enablerss . ";\n" .
782 
+				"\$rss_title = '" . htmlspecialchars(addquotes($_POST["rss_title"])) . "';\n" .
783 
+				"\$rss_link = '" . htmlspecialchars($_POST["rss_link"]) . "';\n" .
784 
+				"\$rss_description = '" . htmlspecialchars(addquotes($_POST["rss_description"])) . "';\n" .
785 
+				"\$website_url = '" . htmlspecialchars($_POST["website_url"]) . "';\n" .
786 
+				"\$announce_url0 = '" . htmlspecialchars($_POST["announce_url0"]) . "';\n" .
787 
+				"\$announce_url1 = '" . htmlspecialchars($_POST["announce_url1"]) . "';\n" .
788 
+				"\$announce_url2 = '" . htmlspecialchars($_POST["announce_url2"]) . "';\n" .
789 
+				"\$announce_url3 = '" . htmlspecialchars($_POST["announce_url3"]) . "';\n" .
790 
+				"\$announce_url4 = '" . htmlspecialchars($_POST["announce_url4"]) . "';\n" .
791 
+				"\$GLOBALS['max_upload_rate'] = " . htmlspecialchars($_POST['max_upload_rate']) . ";\n" .
792 
+				"\$GLOBALS['max_uploads'] = " . htmlspecialchars($_POST['max_uploads']) . ";\n" .
793 
+				"\$dateformat = '" . htmlspecialchars($_POST["dateformat"]) . "';\n" .
794 
+				"\$timezone = '" . htmlspecialchars($_POST["timezone"]) . "';\n" .
795 
+				"\$prefix = '" . htmlspecialchars($_POST["prefix"]) . "';\n" .
796 
+				"?>"
797 
+				);
798 
+
799 
+				fclose($fd);
800 
+			}
751 801 
 			echo "<br><p class=\"success\">config.php file was created successfully!</p>";
752 802 
 		}
753 803
754 804 
 		//if unable to create on server, user downloads config.php file for future upload
755 
-		if (!is_writable("./"))
805 
+		if (version_compare(PHP_VERSION, '5.5.0*', '>='))
756 806 
 		{
757 
-			?>
758 
-			<h2>"config.php" was unable to be created on the server,
759 
-			you will have to download the file and upload it manually.</h2>
760 
-			<br>
761 
-			<form method="post" action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>">
762 
-			<input type="hidden" name="download" value="1">
763 
-			<input type="hidden" name="hiddentracker" value="<?php if (isset($_POST['hiddentracker']) AND $_POST['hiddentracker'] == 'on') echo 'true'; else echo 'false';?>">
764 
-			<input type="hidden" name="scrape" value="<?php if (isset($_POST['scrape']) AND $_POST['scrape'] == 'on') echo 'true'; else echo 'false';?>">
765 
-			<input type="hidden" name="customtitle" value="<?php if (isset($_POST['customtitle']) AND $_POST['customtitle'] == 'on') echo 'true'; else echo 'false';?>">
766 
-			<input type="hidden" name="indexpagelimitspecify" value="<?php echo $_POST['indexpagelimitspecify'];?>">
767 
-			<input type="hidden" name="statspagelimitspecify" value="<?php echo $_POST['statspagelimitspecify'];?>">
768 
-			<input type="hidden" name="report_interval" value="<?php echo $_POST['report_interval'];?>">
769 
-			<input type="hidden" name="min_interval" value="<?php echo $_POST['min_interval'];?>">
770 
-			<input type="hidden" name="maxpeers" value="<?php echo $_POST['maxpeers'];?>">
771 
-			<input type="hidden" name="NAT" value="<?php if (isset($_POST['NAT']) AND $_POST['NAT'] == 'on') echo 'true'; else echo 'false';?>">
772 
-			<input type="hidden" name="persist" value="<?php if (isset($_POST['persist']) AND $_POST['persist'] == 'on') echo 'true'; else echo 'false';?>">
773 
-			<input type="hidden" name="ip_override" value="<?php if (isset($_POST['ip_override']) AND $_POST['ip_override'] == 'on') echo 'true'; else echo 'false';?>">
774 
-			<input type="hidden" name="countbytes" value="<?php if (isset($_POST['countbytes']) AND $_POST['countbytes'] == 'on') echo 'true'; else echo 'false';?>">
775 
-			<input type="hidden" name="upload_username" value="<?php echo $_POST['upload_username'];?>">
776 
-			<input type="hidden" name="upload_password" value="<?php echo md5($_POST["upload_username"].$_POST["upload_password"]);?>">
777 
-			<input type="hidden" name="admin_username" value="<?php echo $_POST['admin_username'];?>">
778 
-			<input type="hidden" name="admin_password" value="<?php echo md5($_POST["admin_username"].$_POST["admin_password"]);?>">
779 
-			<input type="hidden" name="title" value="<?php echo $_POST['title'];?>">
780 
-			<input type="hidden" name="dbhost" value="<?php echo $_POST['dbhost'];?>">
781 
-			<input type="hidden" name="dbuser" value="<?php echo $_POST['dbuser'];?>">
782 
-			<input type="hidden" name="dbpass" value="<?php echo $_POST['dbpass'];?>">
783 
-			<input type="hidden" name="database" value="<?php echo $_POST['database'];?>">
784 
-			<input type="hidden" name="enablerss" value="<?php if (isset($_POST['enablerss']) AND $_POST['enablerss'] == 'on') echo 'true'; else echo 'false';?>">
785 
-			<input type="hidden" name="rss_title" value="<?php echo $_POST['rss_title'];?>">
786 
-			<input type="hidden" name="rss_link" value="<?php echo $_POST['rss_link'];?>">
787 
-			<input type="hidden" name="rss_description" value="<?php echo $_POST['rss_description'];?>">
788 
-			<input type="hidden" name="website_url" value="<?php echo $_POST['website_url'];?>">
789 
-			<input type="hidden" name="announce_url0" value="<?php echo $_POST['announce_url0'];?>">
790 
-			<input type="hidden" name="announce_url1" value="<?php echo $_POST['announce_url1'];?>">
791 
-			<input type="hidden" name="announce_url2" value="<?php echo $_POST['announce_url2'];?>">
792 
-			<input type="hidden" name="announce_url3" value="<?php echo $_POST['announce_url3'];?>">
793 
-			<input type="hidden" name="announce_url4" value="<?php echo $_POST['announce_url4'];?>">
794 
-			<input type="hidden" name="max_upload_rate" value="<?php echo $_POST['max_upload_rate'];?>">
795 
-			<input type="hidden" name="max_uploads" value="<?php echo $_POST['max_uploads'];?>">
796 
-			<input type="hidden" name="dateformat" value="<?php echo $_POST['dateformat'];?>">
797 
-			<input type="hidden" name="timezone" value="<?php echo $_POST['timezone'];?>">
798 
-			<input type="hidden" name="prefix" value="<?php echo $_POST['prefix'];?>">
799 
-			<input type="submit" value="Download config.php File">
800 
-			</form>
801 
-			<br>
802 
-			<?php
807 
+			if (!is_writable("./"))
808 
+			{
809 
+				?>
810 
+				<h2>"config.php" was unable to be created on the server,
811 
+				you will have to download the file and upload it manually.</h2>
812 
+				<br>
813 
+				<form method="post" action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>">
814 
+				<input type="hidden" name="download" value="1">
815 
+				<input type="hidden" name="hiddentracker" value="<?php if (isset($_POST['hiddentracker']) AND $_POST['hiddentracker'] == 'on') echo 'true'; else echo 'false';?>">
816 
+				<input type="hidden" name="scrape" value="<?php if (isset($_POST['scrape']) AND $_POST['scrape'] == 'on') echo 'true'; else echo 'false';?>">
817 
+				<input type="hidden" name="customtitle" value="<?php if (isset($_POST['customtitle']) AND $_POST['customtitle'] == 'on') echo 'true'; else echo 'false';?>">
818 
+				<input type="hidden" name="indexpagelimitspecify" value="<?php echo $_POST['indexpagelimitspecify'];?>">
819 
+				<input type="hidden" name="statspagelimitspecify" value="<?php echo $_POST['statspagelimitspecify'];?>">
820 
+				<input type="hidden" name="report_interval" value="<?php echo $_POST['report_interval'];?>">
821 
+				<input type="hidden" name="min_interval" value="<?php echo $_POST['min_interval'];?>">
822 
+				<input type="hidden" name="maxpeers" value="<?php echo $_POST['maxpeers'];?>">
823 
+				<input type="hidden" name="NAT" value="<?php if (isset($_POST['NAT']) AND $_POST['NAT'] == 'on') echo 'true'; else echo 'false';?>">
824 
+				<input type="hidden" name="persist" value="<?php if (isset($_POST['persist']) AND $_POST['persist'] == 'on') echo 'true'; else echo 'false';?>">
825 
+				<input type="hidden" name="ip_override" value="<?php if (isset($_POST['ip_override']) AND $_POST['ip_override'] == 'on') echo 'true'; else echo 'false';?>">
826 
+				<input type="hidden" name="countbytes" value="<?php if (isset($_POST['countbytes']) AND $_POST['countbytes'] == 'on') echo 'true'; else echo 'false';?>">
827 
+				<input type="hidden" name="upload_username" value="<?php echo $_POST['upload_username'];?>">
828 
+				<input type="hidden" name="upload_password" value="<?php echo password_hash($_POST["upload_username"].$_POST["upload_password"], PASSWORD_BCRYPT);?>">
829 
+				<input type="hidden" name="admin_username" value="<?php echo $_POST['admin_username'];?>">
830 
+				<input type="hidden" name="admin_password" value="<?php echo password_hash($_POST["admin_username"].$_POST["admin_password"], PASSWORD_BCRYPT);?>">
831 
+				<input type="hidden" name="title" value="<?php echo $_POST['title'];?>">
832 
+				<input type="hidden" name="dbhost" value="<?php echo $_POST['dbhost'];?>">
833 
+				<input type="hidden" name="dbuser" value="<?php echo $_POST['dbuser'];?>">
834 
+				<input type="hidden" name="dbpass" value="<?php echo $_POST['dbpass'];?>">
835 
+				<input type="hidden" name="database" value="<?php echo $_POST['database'];?>">
836 
+				<input type="hidden" name="enablerss" value="<?php if (isset($_POST['enablerss']) AND $_POST['enablerss'] == 'on') echo 'true'; else echo 'false';?>">
837 
+				<input type="hidden" name="rss_title" value="<?php echo $_POST['rss_title'];?>">
838 
+				<input type="hidden" name="rss_link" value="<?php echo $_POST['rss_link'];?>">
839 
+				<input type="hidden" name="rss_description" value="<?php echo $_POST['rss_description'];?>">
840 
+				<input type="hidden" name="website_url" value="<?php echo $_POST['website_url'];?>">
841 
+				<input type="hidden" name="announce_url0" value="<?php echo $_POST['announce_url0'];?>">
842 
+				<input type="hidden" name="announce_url1" value="<?php echo $_POST['announce_url1'];?>">
843 
+				<input type="hidden" name="announce_url2" value="<?php echo $_POST['announce_url2'];?>">
844 
+				<input type="hidden" name="announce_url3" value="<?php echo $_POST['announce_url3'];?>">
845 
+				<input type="hidden" name="announce_url4" value="<?php echo $_POST['announce_url4'];?>">
846 
+				<input type="hidden" name="max_upload_rate" value="<?php echo $_POST['max_upload_rate'];?>">
847 
+				<input type="hidden" name="max_uploads" value="<?php echo $_POST['max_uploads'];?>">
848 
+				<input type="hidden" name="dateformat" value="<?php echo $_POST['dateformat'];?>">
849 
+				<input type="hidden" name="timezone" value="<?php echo $_POST['timezone'];?>">
850 
+				<input type="hidden" name="prefix" value="<?php echo $_POST['prefix'];?>">
851 
+				<input type="submit" value="Download config.php File">
852 
+				</form>
853 
+				<br>
854 
+				<?php
855 
+			}
856 
+		}
857 
+
858 
+		if (version_compare(PHP_VERSION, '5.4.0*', '<='))
859 
+		{
860 
+			if (!is_writable("./"))
861 
+			{
862 
+				?>
863 
+				<h2>"config.php" was unable to be created on the server,
864 
+				you will have to download the file and upload it manually.</h2>
865 
+				<br>
866 
+				<form method="post" action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>">
867 
+				<input type="hidden" name="download" value="1">
868 
+				<input type="hidden" name="hiddentracker" value="<?php if (isset($_POST['hiddentracker']) AND $_POST['hiddentracker'] == 'on') echo 'true'; else echo 'false';?>">
869 
+				<input type="hidden" name="scrape" value="<?php if (isset($_POST['scrape']) AND $_POST['scrape'] == 'on') echo 'true'; else echo 'false';?>">
870 
+				<input type="hidden" name="customtitle" value="<?php if (isset($_POST['customtitle']) AND $_POST['customtitle'] == 'on') echo 'true'; else echo 'false';?>">
871 
+				<input type="hidden" name="indexpagelimitspecify" value="<?php echo $_POST['indexpagelimitspecify'];?>">
872 
+				<input type="hidden" name="statspagelimitspecify" value="<?php echo $_POST['statspagelimitspecify'];?>">
873 
+				<input type="hidden" name="report_interval" value="<?php echo $_POST['report_interval'];?>">
874 
+				<input type="hidden" name="min_interval" value="<?php echo $_POST['min_interval'];?>">
875 
+				<input type="hidden" name="maxpeers" value="<?php echo $_POST['maxpeers'];?>">
876 
+				<input type="hidden" name="NAT" value="<?php if (isset($_POST['NAT']) AND $_POST['NAT'] == 'on') echo 'true'; else echo 'false';?>">
877 
+				<input type="hidden" name="persist" value="<?php if (isset($_POST['persist']) AND $_POST['persist'] == 'on') echo 'true'; else echo 'false';?>">
878 
+				<input type="hidden" name="ip_override" value="<?php if (isset($_POST['ip_override']) AND $_POST['ip_override'] == 'on') echo 'true'; else echo 'false';?>">
879 
+				<input type="hidden" name="countbytes" value="<?php if (isset($_POST['countbytes']) AND $_POST['countbytes'] == 'on') echo 'true'; else echo 'false';?>">
880 
+				<input type="hidden" name="upload_username" value="<?php echo $_POST['upload_username'];?>">
881 
+				<input type="hidden" name="upload_password" value="<?php echo crypt($_POST["upload_username"].$_POST["upload_password"]);?>">
882 
+				<input type="hidden" name="admin_username" value="<?php echo $_POST['admin_username'];?>">
883 
+				<input type="hidden" name="admin_password" value="<?php echo crypt($_POST["admin_username"].$_POST["admin_password"]);?>">
884 
+				<input type="hidden" name="title" value="<?php echo $_POST['title'];?>">
885 
+				<input type="hidden" name="dbhost" value="<?php echo $_POST['dbhost'];?>">
886 
+				<input type="hidden" name="dbuser" value="<?php echo $_POST['dbuser'];?>">
887 
+				<input type="hidden" name="dbpass" value="<?php echo $_POST['dbpass'];?>">
888 
+				<input type="hidden" name="database" value="<?php echo $_POST['database'];?>">
889 
+				<input type="hidden" name="enablerss" value="<?php if (isset($_POST['enablerss']) AND $_POST['enablerss'] == 'on') echo 'true'; else echo 'false';?>">
890 
+				<input type="hidden" name="rss_title" value="<?php echo $_POST['rss_title'];?>">
891 
+				<input type="hidden" name="rss_link" value="<?php echo $_POST['rss_link'];?>">
892 
+				<input type="hidden" name="rss_description" value="<?php echo $_POST['rss_description'];?>">
893 
+				<input type="hidden" name="website_url" value="<?php echo $_POST['website_url'];?>">
894 
+				<input type="hidden" name="announce_url0" value="<?php echo $_POST['announce_url0'];?>">
895 
+				<input type="hidden" name="announce_url1" value="<?php echo $_POST['announce_url1'];?>">
896 
+				<input type="hidden" name="announce_url2" value="<?php echo $_POST['announce_url2'];?>">
897 
+				<input type="hidden" name="announce_url3" value="<?php echo $_POST['announce_url3'];?>">
898 
+				<input type="hidden" name="announce_url4" value="<?php echo $_POST['announce_url4'];?>">
899 
+				<input type="hidden" name="max_upload_rate" value="<?php echo $_POST['max_upload_rate'];?>">
900 
+				<input type="hidden" name="max_uploads" value="<?php echo $_POST['max_uploads'];?>">
901 
+				<input type="hidden" name="dateformat" value="<?php echo $_POST['dateformat'];?>">
902 
+				<input type="hidden" name="timezone" value="<?php echo $_POST['timezone'];?>">
903 
+				<input type="hidden" name="prefix" value="<?php echo $_POST['prefix'];?>">
904 
+				<input type="submit" value="Download config.php File">
905 
+				</form>
906 
+				<br>
907 
+				<?php
908 
+			}
803 909 
 		}
804 910
805 911 
 		//display message to delete install.php file
login.php
History View file @ 0d35e71
... ... 
@@ -10,26 +10,57 @@ if ($_POST['legalterms'] != "on")
10 10 
 	exit();
11 11 
 }
12 12
13 
-if (md5($_POST['f_user'].$_POST['f_pass']) == $admin_password && $_POST['f_user'] == $admin_username)
13 
+$_GET['php_version'] = PHP_VERSION;
14 
+
15 
+if (version_compare(PHP_VERSION, '5.5.0*', '>='))
14 16 
 {
15 
-	//successful admin login
17 
+
18 
+	if (password_verify($_POST['f_user'].$_POST['f_pass'], $admin_password) == $admin_password && $_POST['f_user'] == $admin_username)
19 
+	{
20 
+		//successful admin login
21 
+		session_start();
22 
+		$_SESSION['admin_logged_in'] = true;
23 
+		$_SESSION['username'] = $admin_username;
24 
+		header("Location: admin.php");
25 
+		exit();
26 
+	}
27 
+
28 
+	if (password_verify($_POST['f_user'].$_POST['f_pass'], $upload_password) == $upload_password && $_POST['f_user'] == $upload_username)
29 
+	{
30 
+	//successful upload login
16 31 
 	session_start();
17 
-	$_SESSION['admin_logged_in'] = true;
18 
-	$_SESSION['username'] = $admin_username;
19 
-	header("Location: admin.php");
32 
+	$_SESSION['upload_logged_in'] = true;
33 
+	$_SESSION['username'] = $upload_username;
34 
+	header("Location: index.php");
20 35 
 	exit();
36 
+	}
21 37 
 }
22 38
23 
-if (md5($_POST['f_user'].$_POST['f_pass']) == $upload_password && $_POST['f_user'] == $upload_username)
39 
+else if (version_compare(PHP_VERSION, '5.4.0*', '<='))
24 40 
 {
41 
+
42 
+	if (crypt($_POST['f_user'].$_POST['f_pass'], $admin_password) == $admin_password && $_POST['f_user'] == $admin_username)
43 
+	{
44 
+		//successful admin login
45 
+		session_start();
46 
+		$_SESSION['admin_logged_in'] = true;
47 
+		$_SESSION['username'] = $admin_username;
48 
+		header("Location: admin.php");
49 
+		exit();
50 
+	}
51 
+
52 
+	if (crypt($_POST['f_user'].$_POST['f_pass'], $upload_password) == $upload_password && $_POST['f_user'] == $upload_username)
53 
+	{
25 54 
 	//successful upload login
26 55 
 	session_start();
27 56 
 	$_SESSION['upload_logged_in'] = true;
28 57 
 	$_SESSION['username'] = $upload_username;
29 58 
 	header("Location: index.php");
30 59 
 	exit();
60 
+	}
31 61 
 }
32 62
63 
+
33 64 
 //Username or password was incorrect at this point!
34 65 
 header("Location: authenticate.php?status=error");
35 66 
 exit();