Password conversion: MD5 -> bcrypt with a cost of 12. This change also causes the user to log off the site every time the password is changed.
--- a/admin/members.php
+++ b/admin/members.php
@@ -87,7 +87,7 @@
mt_srand((double)microtime() * 1000000);
$charset = '23456789' . 'abcdefghijkmnpqrstuvwxyz' . 'ABCDEFGHJKLMNPQRSTUVWXYZ';
$pass = random_string($charset, 10);
- $encryppass = md5($pass);
+ $encryppass = password_hash($pass, PASSWORD_BCRYPT, ['cost' => 12]);
//$headers = "From: $sitename\n";
dbquery("UPDATE "._AUTHORTABLE." SET "._PASSWORDFIELD." = '$encryppass' WHERE uid = '".$_GET['release']."'");
--- a/install/install.php
+++ b/install/install.php
@@ -192,7 +192,7 @@
if ((!$_POST['email']) && !isADMIN) $fail .= "<div style='text-align: center;'>" . _EMAILREQUIRED . " " . _TRYAGAIN . "</div>";
if ($penname && !preg_match("!^[a-z0-9_ ]{3,30}$!i", $penname)) $fail = "<div style='text-align: center;'>" . _BADUSERNAME . " " . _TRYAGAIN . "</div>";
if (!preg_match("/^[a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+\.[a-zA-Z0-9.-]+$/", $_POST['email'])) $fail = "<div style='text-align: center;'>" . _INVALIDEMAIL . " " . _TRYAGAIN . "</div>";
- if ($_POST['password'] == $_POST['password2']) $encryptpassword = md5($_POST['password']);
+ if ($_POST['password'] == $_POST['password2']) $encryptpassword = password_hash($_POST['password'], PASSWORD_BCRYPT, ['cost' => 12]);
else $fail = write_message(_PASSWORDTWICE);
if (!isset($fail))
{
@@ -531,7 +531,7 @@
`image` varchar(200) NOT NULL default '',
`date`int(10) unsigned NOT NULL default '0',
`admincreated` char(1) NOT NULL default '0',
- `password` varchar(40) NOT NULL default '0',
+ `password` varchar(255) NOT NULL default '0',
PRIMARY KEY (`uid`),
KEY `penname` (`penname`),
KEY `admincreated` (`admincreated`)
--- a/languages/en.php
+++ b/languages/en.php
@@ -65,6 +65,7 @@
define ("_LIKE", "like");
define ("_LIKES_NUMBER", "Number of Likes");
define ("_LOGIN", "Log In");
+define ("_LOGINAGAIN", "<br>However, if you have changed your password, you will have to <a href=\"login.php\">login again</a>.");
define ("_PLEASELOGIN", "Please login to access this feature.");
define ("_MEMBER", "Member");
define ("_MEMBERS", "Members");
--- a/user/editbio.php
+++ b/user/editbio.php
@@ -68,7 +68,7 @@
if(!$pwdsetting) {
$charset = '23456789' . 'abcdefghijkmnpqrstuvwxyz' . 'ABCDEFGHJKLMNPQRSTUVWXYZ';
$pass = random_string($charset, 10);
- $encryppass = md5($pass);
+ $encryppass = password_hash($pass, PASSWORD_BCRYPT, ['cost' => 12]);
}
else {
if($_POST['password'] != $_POST['password2']) {
@@ -79,7 +79,7 @@
exit( );
}
$pass = $_POST['password2'];
- $encryppass = md5($pass);
+ $encryppass = password_hash($pass, PASSWORD_BCRYPT, ['cost' => 12]);
}
dbquery("INSERT INTO ".substr(_AUTHORTABLE, 0, strpos(_AUTHORTABLE, "as author"))." (penname, realname, bio, email, date, password) VALUES ('".escapestring($penname)."', '".escapestring(strip_tags($_POST['realname']))."', '".strip_tags(escapestring($_POST['bio']), $allowed_tags)."', '$email'," . time() . ", '$encryppass')");
$useruid = dbinsertid();
@@ -153,7 +153,7 @@
else{
if(($_POST['password']) && ($_POST['password2'])) {
if($_POST['password'] == $_POST['password2']) {
- $encryppassword = md5($_POST['password']);
+ $encryppassword = password_hash($_POST['password'], PASSWORD_BCRYPT, ['cost' => 12]);
dbquery("UPDATE "._AUTHORTABLE." SET password='$encryppassword' WHERE uid = '$uid'");
}
else $output .= write_error(_PASSWORDTWICE);
@@ -183,7 +183,7 @@
}
/* End dynamic fields */
dbquery("UPDATE "._AUTHORTABLE." SET realname='".descript(strip_tags(escapestring($_POST['realname'])), $allowed_tags)."', email='$email', bio='".descript(strip_tags(escapestring($_POST['bio']), $allowed_tags))."', image='".($imageupload && !empty($_POST['image']) ? escapestring($_POST['image']) : "")."' WHERE uid = '$uid'");
- $output .= write_message(_ACTIONSUCCESSFUL." ".(isset($_GET['uid']) ? _BACK2ADMIN : _BACK2ACCT));
+ $output .= write_message(_ACTIONSUCCESSFUL." ".(isset($_GET['uid']) ? _BACK2ADMIN : _BACK2ACCT." "._LOGINAGAIN));
}
}
else {
--- a/user/login.php
+++ b/user/login.php
@@ -52,7 +52,8 @@
header("Location: maintenance.php");
exit( );
}
- $encryptedpassword = md5($_POST['password']);
+ $encryptedpasswordb = $passwd['password'];
+ $encryptedpasswordm = md5($_POST['password']);
if($passwd['level'] == -1) {
require_once("header.php");
//make a new TemplatePower object
@@ -65,14 +66,28 @@
dbclose( );
exit( );
}
- if($passwd['password'] == $encryptedpassword) {
+ if(password_verify($_POST['password'], $encryptedpasswordb) == $encryptedpasswordb) {
if(isset($_POST['cookiecheck'])) {
setcookie($sitekey."_useruid",$passwd['uid'], time()+60*60*24*30, "/");
- setcookie($sitekey."_salt", md5($passwd['email'] . $encryptedpassword), time()+60*60*24*30, "/");
+ setcookie($sitekey."_salt", md5($passwd['email'] . $encryptedpasswordb), time()+60*60*24*30, "/");
}
if(!isset($_SESSION)) session_start( );
$_SESSION[$sitekey."_useruid"] = $passwd['uid'];
- $_SESSION[$sitekey."_salt"] = md5($passwd['email'] . $encryptedpassword);
+ $_SESSION[$sitekey."_salt"] = md5($passwd['email'] . $encryptedpasswordb);
+ $logincode = dbquery("SELECT * FROM ".TABLEPREFIX."fanfiction_codeblocks WHERE code_type = 'login'");
+ while($code = dbassoc($logincode)) {
+ eval($code['code_text']);
+ }
+ }
+
+ else if($passwd['password'] == $encryptedpasswordm) {
+ if(isset($_POST['cookiecheck'])) {
+ setcookie($sitekey."_useruid",$passwd['uid'], time()+60*60*24*30, "/");
+ setcookie($sitekey."_salt", md5($passwd['email'] . $encryptedpasswordm), time()+60*60*24*30, "/");
+ }
+ if(!isset($_SESSION)) session_start( );
+ $_SESSION[$sitekey."_useruid"] = $passwd['uid'];
+ $_SESSION[$sitekey."_salt"] = md5($passwd['email'] . $encryptedpasswordm);
$logincode = dbquery("SELECT * FROM ".TABLEPREFIX."fanfiction_codeblocks WHERE code_type = 'login'");
while($code = dbassoc($logincode)) {
eval($code['code_text']);
--- a/user/lostpassword.php
+++ b/user/lostpassword.php
@@ -54,7 +54,7 @@
mt_srand((double)microtime() * 1000000);
$charset = '23456789' . 'abcdefghijkmnpqrstuvwxyz' . 'ABCDEFGHJKLMNPQRSTUVWXYZ';
$pass = random_string($charset, 10);
- $encryppass = md5($pass);
+ $encryppass = password_hash($_POST['password'], PASSWORD_BCRYPT, ['cost' => 12]);
$subject = _NEWPWDSUB;
$mailtext = sprintf(_NEWPWDMSG, $pass);