CW Cyrix's Git Repository Mirror
Browse code

Password authentication changed from ancient MD5 to bcrypt for PHP 5.5 and above, and crypt for PHP versions 5.0 to 5.4.x. Will be more precise later.

Clarissa Walker authored on 2015/09/14 06:58:30
Showing 1 changed files
login.php
History View file @ 0d35e71
... ... 
@@ -10,26 +10,57 @@ if ($_POST['legalterms'] != "on")
10 10 
 	exit();
11 11 
 }
12 12
13 
-if (md5($_POST['f_user'].$_POST['f_pass']) == $admin_password && $_POST['f_user'] == $admin_username)
13 
+$_GET['php_version'] = PHP_VERSION;
14 
+
15 
+if (version_compare(PHP_VERSION, '5.5.0*', '>='))
14 16 
 {
15 
-	//successful admin login
17 
+
18 
+	if (password_verify($_POST['f_user'].$_POST['f_pass'], $admin_password) == $admin_password && $_POST['f_user'] == $admin_username)
19 
+	{
20 
+		//successful admin login
21 
+		session_start();
22 
+		$_SESSION['admin_logged_in'] = true;
23 
+		$_SESSION['username'] = $admin_username;
24 
+		header("Location: admin.php");
25 
+		exit();
26 
+	}
27 
+
28 
+	if (password_verify($_POST['f_user'].$_POST['f_pass'], $upload_password) == $upload_password && $_POST['f_user'] == $upload_username)
29 
+	{
30 
+	//successful upload login
16 31 
 	session_start();
17 
-	$_SESSION['admin_logged_in'] = true;
18 
-	$_SESSION['username'] = $admin_username;
19 
-	header("Location: admin.php");
32 
+	$_SESSION['upload_logged_in'] = true;
33 
+	$_SESSION['username'] = $upload_username;
34 
+	header("Location: index.php");
20 35 
 	exit();
36 
+	}
21 37 
 }
22 38
23 
-if (md5($_POST['f_user'].$_POST['f_pass']) == $upload_password && $_POST['f_user'] == $upload_username)
39 
+else if (version_compare(PHP_VERSION, '5.4.0*', '<='))
24 40 
 {
41 
+
42 
+	if (crypt($_POST['f_user'].$_POST['f_pass'], $admin_password) == $admin_password && $_POST['f_user'] == $admin_username)
43 
+	{
44 
+		//successful admin login
45 
+		session_start();
46 
+		$_SESSION['admin_logged_in'] = true;
47 
+		$_SESSION['username'] = $admin_username;
48 
+		header("Location: admin.php");
49 
+		exit();
50 
+	}
51 
+
52 
+	if (crypt($_POST['f_user'].$_POST['f_pass'], $upload_password) == $upload_password && $_POST['f_user'] == $upload_username)
53 
+	{
25 54 
 	//successful upload login
26 55 
 	session_start();
27 56 
 	$_SESSION['upload_logged_in'] = true;
28 57 
 	$_SESSION['username'] = $upload_username;
29 58 
 	header("Location: index.php");
30 59 
 	exit();
60 
+	}
31 61 
 }
32 62
63 
+
33 64 
 //Username or password was incorrect at this point!
34 65 
 header("Location: authenticate.php?status=error");
35 66 
 exit();
Browse code

Fixes current session username display for hidden tracker --Simply log out and log back in to reset session

Clarissa Walker authored on 2015/09/09 23:40:14
Showing 1 changed files
login.php
History View file @ 150efd9
... ... 
@@ -15,6 +15,7 @@ if (md5($_POST['f_user'].$_POST['f_pass']) == $admin_password && $_POST['f_user'
15 15 
 	//successful admin login
16 16 
 	session_start();
17 17 
 	$_SESSION['admin_logged_in'] = true;
18 
+	$_SESSION['username'] = $admin_username;
18 19 
 	header("Location: admin.php");
19 20 
 	exit();
20 21 
 }
... ... 
@@ -24,6 +25,7 @@ if (md5($_POST['f_user'].$_POST['f_pass']) == $upload_password && $_POST['f_user
24 25 
 	//successful upload login
25 26 
 	session_start();
26 27 
 	$_SESSION['upload_logged_in'] = true;
28 
+	$_SESSION['username'] = $upload_username;
27 29 
 	header("Location: index.php");
28 30 
 	exit();
29 31 
 }
Browse code

Import from the old rivettracker git repository at sourceforge (amisaph/amisapphire branch)

Clarissa Walker (ami-sapphire) authored on 2014/01/24 14:02:23
Showing 1 changed files
login.php
History View file @ 1c8ad06
1 1 
new file mode 100644
... ... 
@@ -0,0 +1,35 @@
1 
+<?php
2 
+//Login Script
3 
+//Validates Username and Password
4 
+require_once ("config.php");
5 
+
6 
+if ($_POST['legalterms'] != "on")
7 
+{
8 
+	//did not agree to legal terms, go back
9 
+	header("Location: authenticate.php?status=legalterms");
10 
+	exit();
11 
+}
12 
+
13 
+if (md5($_POST['f_user'].$_POST['f_pass']) == $admin_password && $_POST['f_user'] == $admin_username)
14 
+{
15 
+	//successful admin login
16 
+	session_start();
17 
+	$_SESSION['admin_logged_in'] = true;
18 
+	header("Location: admin.php");
19 
+	exit();
20 
+}
21 
+
22 
+if (md5($_POST['f_user'].$_POST['f_pass']) == $upload_password && $_POST['f_user'] == $upload_username)
23 
+{
24 
+	//successful upload login
25 
+	session_start();
26 
+	$_SESSION['upload_logged_in'] = true;
27 
+	header("Location: index.php");
28 
+	exit();
29 
+}
30 
+
31 
+//Username or password was incorrect at this point!
32 
+header("Location: authenticate.php?status=error");
33 
+exit();
34 
+
35 
+?>