Password authentication changed from ancient MD5 to bcrypt for PHP 5.5 and
above, and crypt for PHP versions 5.0 to 5.4.x. Will be more precise
later.
--- a/editconfig.php
+++ b/editconfig.php
@@ -138,7 +138,7 @@
Again, this user is only able to create, and not delete torrents to the tracker.
For full privileges, see the admin user.<br><br>
<input type="hidden" name="old_upload_password" value="<?php echo $temp;?>">
- <b>Current MD5 hashed username+password: <?php echo $temp;?></b></td>
+ <b>Current hashed username+password: <?php echo $temp;?></b></td>
<td><input type="password" name="upload_password" size="40" value=""></td></tr>
<?php
$temp = fgets($fr);
@@ -157,7 +157,7 @@
information about the tracker as well as access a few other important tools.
The admin is also able to upload torrents to the database.<br><br>
<input type="hidden" name="old_admin_password" value="<?php echo $temp;?>">
- <b>Current MD5 hashed username+password: <?php echo $temp;?></b></td>
+ <b>Current hashed username+password: <?php echo $temp;?></b></td>
<td><input type="password" name="admin_password" size="40" value=""></td></tr>
<?php
$temp = fgets($fr);
@@ -462,19 +462,39 @@
exit();
}
- //calculate new MD5 password if needed
- if ($_POST["upload_password"] != "")
- {
- $_POST["upload_password"] = md5($_POST["upload_username"].$_POST["upload_password"]);
- }
- else
- $_POST["upload_password"] = $_POST["old_upload_password"];
- if ($_POST["admin_password"] != "")
- {
- $_POST["admin_password"] = md5($_POST["admin_username"].$_POST["admin_password"]);
- }
- else
- $_POST["admin_password"] = $_POST["old_admin_password"];
+ //calculate new password if needed
+ $_GET['php_version'] = PHP_VERSION;
+ if (version_compare(PHP_VERSION, '5.5.0*', '>='))
+ {
+ if ($_POST["upload_password"] != "")
+ {
+ $_POST["upload_password"] = password_hash($_POST["upload_username"].$_POST["upload_password"], PASSWORD_BCRYPT);
+ }
+ else
+ $_POST["upload_password"] = $_POST["old_upload_password"];
+ if ($_POST["admin_password"] != "")
+ {
+ $_POST["admin_password"] = password_hash($_POST["admin_username"].$_POST["admin_password"], PASSWORD_BCRYPT);
+ }
+ else
+ $_POST["admin_password"] = $_POST["old_admin_password"];
+ }
+
+ else if (version_compare(PHP_VERSION, '5.4.0*', '<='))
+ {
+ if ($_POST["upload_password"] != "")
+ {
+ $_POST["upload_password"] = crypt($_POST["upload_username"].$_POST["upload_password"]);
+ }
+ else
+ $_POST["upload_password"] = $_POST["old_upload_password"];
+ if ($_POST["admin_password"] != "")
+ {
+ $_POST["admin_password"] = crypt($_POST["admin_username"].$_POST["admin_password"]);
+ }
+ else
+ $_POST["admin_password"] = $_POST["old_admin_password"];
+ }
//check if config.php has write access
if (is_writable("config.php"))
--- a/install.php
+++ b/install.php
@@ -704,102 +704,208 @@
else
$countbytes = "false";
+ $_GET['php_version'] = PHP_VERSION;
+
//write config.php file
- $fd = fopen("config.php", "w") or die(errorMessage() . "Error: couldn't make config.php!</p>");
- fwrite($fd,
- "<?php //Please do NOT edit this file, use the admin page for changes.\n" .
- "\$GLOBALS['hiddentracker'] = " . $hiddentracker . ";\n" .
- "\$GLOBALS['scrape'] = " . $scrape . ";\n" .
- "\$GLOBALS['customtitle'] = " . $customtitle . ";\n" .
- "\$GLOBALS['indexpagelimitspecify'] = " . htmlspecialchars($_POST["indexpagelimitspecify"]) . ";\n" .
- "\$GLOBALS['statspagelimitspecify'] = " . htmlspecialchars($_POST["statspagelimitspecify"]) . ";\n" .
- "\$GLOBALS['report_interval'] = " . htmlspecialchars($_POST["report_interval"]) . ";\n" .
- "\$GLOBALS['min_interval'] = " . htmlspecialchars($_POST["min_interval"]) . ";\n" .
- "\$GLOBALS['maxpeers'] = " . htmlspecialchars($_POST["maxpeers"]) . ";\n" .
- "\$GLOBALS['NAT'] = " . $NAT . ";\n" .
- "\$GLOBALS['persist'] = " . $persist . ";\n" .
- "\$GLOBALS['ip_override'] = " . $ip_override . ";\n" .
- "\$GLOBALS['countbytes'] = " . $countbytes . ";\n" .
- "\$upload_username = '" . htmlspecialchars($_POST["upload_username"]) . "';\n" .
- "\$upload_password = '" . md5($_POST["upload_username"].$_POST["upload_password"]) . "';\n" .
- "\$admin_username = '" . htmlspecialchars($_POST["admin_username"]) . "';\n" .
- "\$admin_password = '" . md5($_POST["admin_username"].$_POST["admin_password"]) . "';\n" .
- "\$GLOBALS['title'] = '" . htmlspecialchars(addquotes($_POST["title"])) . "';\n" .
- "\$dbhost = '" . htmlspecialchars($_POST["dbhost"]) . "';\n" .
- "\$dbuser = '" . htmlspecialchars($_POST["dbuser"]) . "';\n" .
- "\$dbpass = '" . htmlspecialchars($_POST["dbpass"]) . "';\n" .
- "\$database = '" . htmlspecialchars($_POST["database"]) . "';\n" .
- "\$enablerss = " . $enablerss . ";\n" .
- "\$rss_title = '" . htmlspecialchars(addquotes($_POST["rss_title"])) . "';\n" .
- "\$rss_link = '" . htmlspecialchars($_POST["rss_link"]) . "';\n" .
- "\$rss_description = '" . htmlspecialchars(addquotes($_POST["rss_description"])) . "';\n" .
- "\$website_url = '" . htmlspecialchars($_POST["website_url"]) . "';\n" .
- "\$announce_url0 = '" . htmlspecialchars($_POST["announce_url0"]) . "';\n" .
- "\$announce_url1 = '" . htmlspecialchars($_POST["announce_url1"]) . "';\n" .
- "\$announce_url2 = '" . htmlspecialchars($_POST["announce_url2"]) . "';\n" .
- "\$announce_url3 = '" . htmlspecialchars($_POST["announce_url3"]) . "';\n" .
- "\$announce_url4 = '" . htmlspecialchars($_POST["announce_url4"]) . "';\n" .
- "\$GLOBALS['max_upload_rate'] = " . htmlspecialchars($_POST['max_upload_rate']) . ";\n" .
- "\$GLOBALS['max_uploads'] = " . htmlspecialchars($_POST['max_uploads']) . ";\n" .
- "\$dateformat = '" . htmlspecialchars($_POST["dateformat"]) . "';\n" .
- "\$timezone = '" . htmlspecialchars($_POST["timezone"]) . "';\n" .
- "\$prefix = '" . htmlspecialchars($_POST["prefix"]) . "';\n" .
- "?>"
- );
-
- fclose($fd);
+ if (version_compare(PHP_VERSION, '5.5.0*', '>=')) {
+ $fd = fopen("config.php", "w") or die(errorMessage() . "Error: couldn't make config.php!</p>");
+ fwrite($fd,
+ "<?php //Please do NOT edit this file, use the admin page for changes.\n" .
+ "\$GLOBALS['hiddentracker'] = " . $hiddentracker . ";\n" .
+ "\$GLOBALS['scrape'] = " . $scrape . ";\n" .
+ "\$GLOBALS['customtitle'] = " . $customtitle . ";\n" .
+ "\$GLOBALS['indexpagelimitspecify'] = " . htmlspecialchars($_POST["indexpagelimitspecify"]) . ";\n" .
+ "\$GLOBALS['statspagelimitspecify'] = " . htmlspecialchars($_POST["statspagelimitspecify"]) . ";\n" .
+ "\$GLOBALS['report_interval'] = " . htmlspecialchars($_POST["report_interval"]) . ";\n" .
+ "\$GLOBALS['min_interval'] = " . htmlspecialchars($_POST["min_interval"]) . ";\n" .
+ "\$GLOBALS['maxpeers'] = " . htmlspecialchars($_POST["maxpeers"]) . ";\n" .
+ "\$GLOBALS['NAT'] = " . $NAT . ";\n" .
+ "\$GLOBALS['persist'] = " . $persist . ";\n" .
+ "\$GLOBALS['ip_override'] = " . $ip_override . ";\n" .
+ "\$GLOBALS['countbytes'] = " . $countbytes . ";\n" .
+ "\$upload_username = '" . htmlspecialchars($_POST["upload_username"]) . "';\n" .
+ "\$upload_password = '" . password_hash($_POST["upload_username"].$_POST["upload_password"], PASSWORD_BCRYPT) . "';\n" .
+ "\$admin_username = '" . htmlspecialchars($_POST["admin_username"]) . "';\n" .
+ "\$admin_password = '" . password_hash($_POST["admin_username"].$_POST["admin_password"], PASSWORD_BCRYPT) . "';\n" .
+ "\$GLOBALS['title'] = '" . htmlspecialchars(addquotes($_POST["title"])) . "';\n" .
+ "\$dbhost = '" . htmlspecialchars($_POST["dbhost"]) . "';\n" .
+ "\$dbuser = '" . htmlspecialchars($_POST["dbuser"]) . "';\n" .
+ "\$dbpass = '" . htmlspecialchars($_POST["dbpass"]) . "';\n" .
+ "\$database = '" . htmlspecialchars($_POST["database"]) . "';\n" .
+ "\$enablerss = " . $enablerss . ";\n" .
+ "\$rss_title = '" . htmlspecialchars(addquotes($_POST["rss_title"])) . "';\n" .
+ "\$rss_link = '" . htmlspecialchars($_POST["rss_link"]) . "';\n" .
+ "\$rss_description = '" . htmlspecialchars(addquotes($_POST["rss_description"])) . "';\n" .
+ "\$website_url = '" . htmlspecialchars($_POST["website_url"]) . "';\n" .
+ "\$announce_url0 = '" . htmlspecialchars($_POST["announce_url0"]) . "';\n" .
+ "\$announce_url1 = '" . htmlspecialchars($_POST["announce_url1"]) . "';\n" .
+ "\$announce_url2 = '" . htmlspecialchars($_POST["announce_url2"]) . "';\n" .
+ "\$announce_url3 = '" . htmlspecialchars($_POST["announce_url3"]) . "';\n" .
+ "\$announce_url4 = '" . htmlspecialchars($_POST["announce_url4"]) . "';\n" .
+ "\$GLOBALS['max_upload_rate'] = " . htmlspecialchars($_POST['max_upload_rate']) . ";\n" .
+ "\$GLOBALS['max_uploads'] = " . htmlspecialchars($_POST['max_uploads']) . ";\n" .
+ "\$dateformat = '" . htmlspecialchars($_POST["dateformat"]) . "';\n" .
+ "\$timezone = '" . htmlspecialchars($_POST["timezone"]) . "';\n" .
+ "\$prefix = '" . htmlspecialchars($_POST["prefix"]) . "';\n" .
+ "?>"
+ );
+
+ fclose($fd);
+ }
+
+ else if (version_compare(PHP_VERSION, '5.4.0*', '<=')) {
+ $fd = fopen("config.php", "w") or die(errorMessage() . "Error: couldn't make config.php!</p>");
+ fwrite($fd,
+ "<?php //Please do NOT edit this file, use the admin page for changes.\n" .
+ "\$GLOBALS['hiddentracker'] = " . $hiddentracker . ";\n" .
+ "\$GLOBALS['scrape'] = " . $scrape . ";\n" .
+ "\$GLOBALS['customtitle'] = " . $customtitle . ";\n" .
+ "\$GLOBALS['indexpagelimitspecify'] = " . htmlspecialchars($_POST["indexpagelimitspecify"]) . ";\n" .
+ "\$GLOBALS['statspagelimitspecify'] = " . htmlspecialchars($_POST["statspagelimitspecify"]) . ";\n" .
+ "\$GLOBALS['report_interval'] = " . htmlspecialchars($_POST["report_interval"]) . ";\n" .
+ "\$GLOBALS['min_interval'] = " . htmlspecialchars($_POST["min_interval"]) . ";\n" .
+ "\$GLOBALS['maxpeers'] = " . htmlspecialchars($_POST["maxpeers"]) . ";\n" .
+ "\$GLOBALS['NAT'] = " . $NAT . ";\n" .
+ "\$GLOBALS['persist'] = " . $persist . ";\n" .
+ "\$GLOBALS['ip_override'] = " . $ip_override . ";\n" .
+ "\$GLOBALS['countbytes'] = " . $countbytes . ";\n" .
+ "\$upload_username = '" . htmlspecialchars($_POST["upload_username"]) . "';\n" .
+ "\$upload_password = '" . crypt($_POST["upload_username"].$_POST["upload_password"]) . "';\n" .
+ "\$admin_username = '" . htmlspecialchars($_POST["admin_username"]) . "';\n" .
+ "\$admin_password = '" . crypt($_POST["admin_username"].$_POST["admin_password"]) . "';\n" .
+ "\$GLOBALS['title'] = '" . htmlspecialchars(addquotes($_POST["title"])) . "';\n" .
+ "\$dbhost = '" . htmlspecialchars($_POST["dbhost"]) . "';\n" .
+ "\$dbuser = '" . htmlspecialchars($_POST["dbuser"]) . "';\n" .
+ "\$dbpass = '" . htmlspecialchars($_POST["dbpass"]) . "';\n" .
+ "\$database = '" . htmlspecialchars($_POST["database"]) . "';\n" .
+ "\$enablerss = " . $enablerss . ";\n" .
+ "\$rss_title = '" . htmlspecialchars(addquotes($_POST["rss_title"])) . "';\n" .
+ "\$rss_link = '" . htmlspecialchars($_POST["rss_link"]) . "';\n" .
+ "\$rss_description = '" . htmlspecialchars(addquotes($_POST["rss_description"])) . "';\n" .
+ "\$website_url = '" . htmlspecialchars($_POST["website_url"]) . "';\n" .
+ "\$announce_url0 = '" . htmlspecialchars($_POST["announce_url0"]) . "';\n" .
+ "\$announce_url1 = '" . htmlspecialchars($_POST["announce_url1"]) . "';\n" .
+ "\$announce_url2 = '" . htmlspecialchars($_POST["announce_url2"]) . "';\n" .
+ "\$announce_url3 = '" . htmlspecialchars($_POST["announce_url3"]) . "';\n" .
+ "\$announce_url4 = '" . htmlspecialchars($_POST["announce_url4"]) . "';\n" .
+ "\$GLOBALS['max_upload_rate'] = " . htmlspecialchars($_POST['max_upload_rate']) . ";\n" .
+ "\$GLOBALS['max_uploads'] = " . htmlspecialchars($_POST['max_uploads']) . ";\n" .
+ "\$dateformat = '" . htmlspecialchars($_POST["dateformat"]) . "';\n" .
+ "\$timezone = '" . htmlspecialchars($_POST["timezone"]) . "';\n" .
+ "\$prefix = '" . htmlspecialchars($_POST["prefix"]) . "';\n" .
+ "?>"
+ );
+
+ fclose($fd);
+ }
echo "<br><p class=\"success\">config.php file was created successfully!</p>";
}
//if unable to create on server, user downloads config.php file for future upload
- if (!is_writable("./"))
- {
- ?>
- <h2>"config.php" was unable to be created on the server,
- you will have to download the file and upload it manually.</h2>
- <br>
- <form method="post" action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>">
- <input type="hidden" name="download" value="1">
- <input type="hidden" name="hiddentracker" value="<?php if (isset($_POST['hiddentracker']) AND $_POST['hiddentracker'] == 'on') echo 'true'; else echo 'false';?>">
- <input type="hidden" name="scrape" value="<?php if (isset($_POST['scrape']) AND $_POST['scrape'] == 'on') echo 'true'; else echo 'false';?>">
- <input type="hidden" name="customtitle" value="<?php if (isset($_POST['customtitle']) AND $_POST['customtitle'] == 'on') echo 'true'; else echo 'false';?>">
- <input type="hidden" name="indexpagelimitspecify" value="<?php echo $_POST['indexpagelimitspecify'];?>">
- <input type="hidden" name="statspagelimitspecify" value="<?php echo $_POST['statspagelimitspecify'];?>">
- <input type="hidden" name="report_interval" value="<?php echo $_POST['report_interval'];?>">
- <input type="hidden" name="min_interval" value="<?php echo $_POST['min_interval'];?>">
- <input type="hidden" name="maxpeers" value="<?php echo $_POST['maxpeers'];?>">
- <input type="hidden" name="NAT" value="<?php if (isset($_POST['NAT']) AND $_POST['NAT'] == 'on') echo 'true'; else echo 'false';?>">
- <input type="hidden" name="persist" value="<?php if (isset($_POST['persist']) AND $_POST['persist'] == 'on') echo 'true'; else echo 'false';?>">
- <input type="hidden" name="ip_override" value="<?php if (isset($_POST['ip_override']) AND $_POST['ip_override'] == 'on') echo 'true'; else echo 'false';?>">
- <input type="hidden" name="countbytes" value="<?php if (isset($_POST['countbytes']) AND $_POST['countbytes'] == 'on') echo 'true'; else echo 'false';?>">
- <input type="hidden" name="upload_username" value="<?php echo $_POST['upload_username'];?>">
- <input type="hidden" name="upload_password" value="<?php echo md5($_POST["upload_username"].$_POST["upload_password"]);?>">
- <input type="hidden" name="admin_username" value="<?php echo $_POST['admin_username'];?>">
- <input type="hidden" name="admin_password" value="<?php echo md5($_POST["admin_username"].$_POST["admin_password"]);?>">
- <input type="hidden" name="title" value="<?php echo $_POST['title'];?>">
- <input type="hidden" name="dbhost" value="<?php echo $_POST['dbhost'];?>">
- <input type="hidden" name="dbuser" value="<?php echo $_POST['dbuser'];?>">
- <input type="hidden" name="dbpass" value="<?php echo $_POST['dbpass'];?>">
- <input type="hidden" name="database" value="<?php echo $_POST['database'];?>">
- <input type="hidden" name="enablerss" value="<?php if (isset($_POST['enablerss']) AND $_POST['enablerss'] == 'on') echo 'true'; else echo 'false';?>">
- <input type="hidden" name="rss_title" value="<?php echo $_POST['rss_title'];?>">
- <input type="hidden" name="rss_link" value="<?php echo $_POST['rss_link'];?>">
- <input type="hidden" name="rss_description" value="<?php echo $_POST['rss_description'];?>">
- <input type="hidden" name="website_url" value="<?php echo $_POST['website_url'];?>">
- <input type="hidden" name="announce_url0" value="<?php echo $_POST['announce_url0'];?>">
- <input type="hidden" name="announce_url1" value="<?php echo $_POST['announce_url1'];?>">
- <input type="hidden" name="announce_url2" value="<?php echo $_POST['announce_url2'];?>">
- <input type="hidden" name="announce_url3" value="<?php echo $_POST['announce_url3'];?>">
- <input type="hidden" name="announce_url4" value="<?php echo $_POST['announce_url4'];?>">
- <input type="hidden" name="max_upload_rate" value="<?php echo $_POST['max_upload_rate'];?>">
- <input type="hidden" name="max_uploads" value="<?php echo $_POST['max_uploads'];?>">
- <input type="hidden" name="dateformat" value="<?php echo $_POST['dateformat'];?>">
- <input type="hidden" name="timezone" value="<?php echo $_POST['timezone'];?>">
- <input type="hidden" name="prefix" value="<?php echo $_POST['prefix'];?>">
- <input type="submit" value="Download config.php File">
- </form>
- <br>
- <?php
+ if (version_compare(PHP_VERSION, '5.5.0*', '>='))
+ {
+ if (!is_writable("./"))
+ {
+ ?>
+ <h2>"config.php" was unable to be created on the server,
+ you will have to download the file and upload it manually.</h2>
+ <br>
+ <form method="post" action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>">
+ <input type="hidden" name="download" value="1">
+ <input type="hidden" name="hiddentracker" value="<?php if (isset($_POST['hiddentracker']) AND $_POST['hiddentracker'] == 'on') echo 'true'; else echo 'false';?>">
+ <input type="hidden" name="scrape" value="<?php if (isset($_POST['scrape']) AND $_POST['scrape'] == 'on') echo 'true'; else echo 'false';?>">
+ <input type="hidden" name="customtitle" value="<?php if (isset($_POST['customtitle']) AND $_POST['customtitle'] == 'on') echo 'true'; else echo 'false';?>">
+ <input type="hidden" name="indexpagelimitspecify" value="<?php echo $_POST['indexpagelimitspecify'];?>">
+ <input type="hidden" name="statspagelimitspecify" value="<?php echo $_POST['statspagelimitspecify'];?>">
+ <input type="hidden" name="report_interval" value="<?php echo $_POST['report_interval'];?>">
+ <input type="hidden" name="min_interval" value="<?php echo $_POST['min_interval'];?>">
+ <input type="hidden" name="maxpeers" value="<?php echo $_POST['maxpeers'];?>">
+ <input type="hidden" name="NAT" value="<?php if (isset($_POST['NAT']) AND $_POST['NAT'] == 'on') echo 'true'; else echo 'false';?>">
+ <input type="hidden" name="persist" value="<?php if (isset($_POST['persist']) AND $_POST['persist'] == 'on') echo 'true'; else echo 'false';?>">
+ <input type="hidden" name="ip_override" value="<?php if (isset($_POST['ip_override']) AND $_POST['ip_override'] == 'on') echo 'true'; else echo 'false';?>">
+ <input type="hidden" name="countbytes" value="<?php if (isset($_POST['countbytes']) AND $_POST['countbytes'] == 'on') echo 'true'; else echo 'false';?>">
+ <input type="hidden" name="upload_username" value="<?php echo $_POST['upload_username'];?>">
+ <input type="hidden" name="upload_password" value="<?php echo password_hash($_POST["upload_username"].$_POST["upload_password"], PASSWORD_BCRYPT);?>">
+ <input type="hidden" name="admin_username" value="<?php echo $_POST['admin_username'];?>">
+ <input type="hidden" name="admin_password" value="<?php echo password_hash($_POST["admin_username"].$_POST["admin_password"], PASSWORD_BCRYPT);?>">
+ <input type="hidden" name="title" value="<?php echo $_POST['title'];?>">
+ <input type="hidden" name="dbhost" value="<?php echo $_POST['dbhost'];?>">
+ <input type="hidden" name="dbuser" value="<?php echo $_POST['dbuser'];?>">
+ <input type="hidden" name="dbpass" value="<?php echo $_POST['dbpass'];?>">
+ <input type="hidden" name="database" value="<?php echo $_POST['database'];?>">
+ <input type="hidden" name="enablerss" value="<?php if (isset($_POST['enablerss']) AND $_POST['enablerss'] == 'on') echo 'true'; else echo 'false';?>">
+ <input type="hidden" name="rss_title" value="<?php echo $_POST['rss_title'];?>">
+ <input type="hidden" name="rss_link" value="<?php echo $_POST['rss_link'];?>">
+ <input type="hidden" name="rss_description" value="<?php echo $_POST['rss_description'];?>">
+ <input type="hidden" name="website_url" value="<?php echo $_POST['website_url'];?>">
+ <input type="hidden" name="announce_url0" value="<?php echo $_POST['announce_url0'];?>">
+ <input type="hidden" name="announce_url1" value="<?php echo $_POST['announce_url1'];?>">
+ <input type="hidden" name="announce_url2" value="<?php echo $_POST['announce_url2'];?>">
+ <input type="hidden" name="announce_url3" value="<?php echo $_POST['announce_url3'];?>">
+ <input type="hidden" name="announce_url4" value="<?php echo $_POST['announce_url4'];?>">
+ <input type="hidden" name="max_upload_rate" value="<?php echo $_POST['max_upload_rate'];?>">
+ <input type="hidden" name="max_uploads" value="<?php echo $_POST['max_uploads'];?>">
+ <input type="hidden" name="dateformat" value="<?php echo $_POST['dateformat'];?>">
+ <input type="hidden" name="timezone" value="<?php echo $_POST['timezone'];?>">
+ <input type="hidden" name="prefix" value="<?php echo $_POST['prefix'];?>">
+ <input type="submit" value="Download config.php File">
+ </form>
+ <br>
+ <?php
+ }
+ }
+
+ if (version_compare(PHP_VERSION, '5.4.0*', '<='))
+ {
+ if (!is_writable("./"))
+ {
+ ?>
+ <h2>"config.php" was unable to be created on the server,
+ you will have to download the file and upload it manually.</h2>
+ <br>
+ <form method="post" action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>">
+ <input type="hidden" name="download" value="1">
+ <input type="hidden" name="hiddentracker" value="<?php if (isset($_POST['hiddentracker']) AND $_POST['hiddentracker'] == 'on') echo 'true'; else echo 'false';?>">
+ <input type="hidden" name="scrape" value="<?php if (isset($_POST['scrape']) AND $_POST['scrape'] == 'on') echo 'true'; else echo 'false';?>">
+ <input type="hidden" name="customtitle" value="<?php if (isset($_POST['customtitle']) AND $_POST['customtitle'] == 'on') echo 'true'; else echo 'false';?>">
+ <input type="hidden" name="indexpagelimitspecify" value="<?php echo $_POST['indexpagelimitspecify'];?>">
+ <input type="hidden" name="statspagelimitspecify" value="<?php echo $_POST['statspagelimitspecify'];?>">
+ <input type="hidden" name="report_interval" value="<?php echo $_POST['report_interval'];?>">
+ <input type="hidden" name="min_interval" value="<?php echo $_POST['min_interval'];?>">
+ <input type="hidden" name="maxpeers" value="<?php echo $_POST['maxpeers'];?>">
+ <input type="hidden" name="NAT" value="<?php if (isset($_POST['NAT']) AND $_POST['NAT'] == 'on') echo 'true'; else echo 'false';?>">
+ <input type="hidden" name="persist" value="<?php if (isset($_POST['persist']) AND $_POST['persist'] == 'on') echo 'true'; else echo 'false';?>">
+ <input type="hidden" name="ip_override" value="<?php if (isset($_POST['ip_override']) AND $_POST['ip_override'] == 'on') echo 'true'; else echo 'false';?>">
+ <input type="hidden" name="countbytes" value="<?php if (isset($_POST['countbytes']) AND $_POST['countbytes'] == 'on') echo 'true'; else echo 'false';?>">
+ <input type="hidden" name="upload_username" value="<?php echo $_POST['upload_username'];?>">
+ <input type="hidden" name="upload_password" value="<?php echo crypt($_POST["upload_username"].$_POST["upload_password"]);?>">
+ <input type="hidden" name="admin_username" value="<?php echo $_POST['admin_username'];?>">
+ <input type="hidden" name="admin_password" value="<?php echo crypt($_POST["admin_username"].$_POST["admin_password"]);?>">
+ <input type="hidden" name="title" value="<?php echo $_POST['title'];?>">
+ <input type="hidden" name="dbhost" value="<?php echo $_POST['dbhost'];?>">
+ <input type="hidden" name="dbuser" value="<?php echo $_POST['dbuser'];?>">
+ <input type="hidden" name="dbpass" value="<?php echo $_POST['dbpass'];?>">
+ <input type="hidden" name="database" value="<?php echo $_POST['database'];?>">
+ <input type="hidden" name="enablerss" value="<?php if (isset($_POST['enablerss']) AND $_POST['enablerss'] == 'on') echo 'true'; else echo 'false';?>">
+ <input type="hidden" name="rss_title" value="<?php echo $_POST['rss_title'];?>">
+ <input type="hidden" name="rss_link" value="<?php echo $_POST['rss_link'];?>">
+ <input type="hidden" name="rss_description" value="<?php echo $_POST['rss_description'];?>">
+ <input type="hidden" name="website_url" value="<?php echo $_POST['website_url'];?>">
+ <input type="hidden" name="announce_url0" value="<?php echo $_POST['announce_url0'];?>">
+ <input type="hidden" name="announce_url1" value="<?php echo $_POST['announce_url1'];?>">
+ <input type="hidden" name="announce_url2" value="<?php echo $_POST['announce_url2'];?>">
+ <input type="hidden" name="announce_url3" value="<?php echo $_POST['announce_url3'];?>">
+ <input type="hidden" name="announce_url4" value="<?php echo $_POST['announce_url4'];?>">
+ <input type="hidden" name="max_upload_rate" value="<?php echo $_POST['max_upload_rate'];?>">
+ <input type="hidden" name="max_uploads" value="<?php echo $_POST['max_uploads'];?>">
+ <input type="hidden" name="dateformat" value="<?php echo $_POST['dateformat'];?>">
+ <input type="hidden" name="timezone" value="<?php echo $_POST['timezone'];?>">
+ <input type="hidden" name="prefix" value="<?php echo $_POST['prefix'];?>">
+ <input type="submit" value="Download config.php File">
+ </form>
+ <br>
+ <?php
+ }
}
//display message to delete install.php file
--- a/login.php
+++ b/login.php
@@ -10,25 +10,56 @@
exit();
}
-if (md5($_POST['f_user'].$_POST['f_pass']) == $admin_password && $_POST['f_user'] == $admin_username)
+$_GET['php_version'] = PHP_VERSION;
+
+if (version_compare(PHP_VERSION, '5.5.0*', '>='))
{
- //successful admin login
- session_start();
- $_SESSION['admin_logged_in'] = true;
- $_SESSION['username'] = $admin_username;
- header("Location: admin.php");
- exit();
-}
-if (md5($_POST['f_user'].$_POST['f_pass']) == $upload_password && $_POST['f_user'] == $upload_username)
-{
+ if (password_verify($_POST['f_user'].$_POST['f_pass'], $admin_password) == $admin_password && $_POST['f_user'] == $admin_username)
+ {
+ //successful admin login
+ session_start();
+ $_SESSION['admin_logged_in'] = true;
+ $_SESSION['username'] = $admin_username;
+ header("Location: admin.php");
+ exit();
+ }
+
+ if (password_verify($_POST['f_user'].$_POST['f_pass'], $upload_password) == $upload_password && $_POST['f_user'] == $upload_username)
+ {
//successful upload login
session_start();
$_SESSION['upload_logged_in'] = true;
$_SESSION['username'] = $upload_username;
header("Location: index.php");
exit();
+ }
}
+
+else if (version_compare(PHP_VERSION, '5.4.0*', '<='))
+{
+
+ if (crypt($_POST['f_user'].$_POST['f_pass'], $admin_password) == $admin_password && $_POST['f_user'] == $admin_username)
+ {
+ //successful admin login
+ session_start();
+ $_SESSION['admin_logged_in'] = true;
+ $_SESSION['username'] = $admin_username;
+ header("Location: admin.php");
+ exit();
+ }
+
+ if (crypt($_POST['f_user'].$_POST['f_pass'], $upload_password) == $upload_password && $_POST['f_user'] == $upload_username)
+ {
+ //successful upload login
+ session_start();
+ $_SESSION['upload_logged_in'] = true;
+ $_SESSION['username'] = $upload_username;
+ header("Location: index.php");
+ exit();
+ }
+}
+
//Username or password was incorrect at this point!
header("Location: authenticate.php?status=error");