add MD5 password check and warning in Edit Personal Information page
--- a/languages/en.php
+++ b/languages/en.php
@@ -294,6 +294,7 @@
define ("_EDITPERSONAL", "Edit Personal Information");
define ("_EMAILINUSE", "This email address has already been used to sign up for an account. If you've lost your password, please generate a new one by using the <a href=\"user.php?action=lostpassword\">lost password</a> feature.");
define ("_ICQ", "ICQ");
+define ("_INSECUREPWD", "Your password is hashed using unsalted MD5, a known insecure hashing algorithm. Please update your password so it can be converted to the more secure bcrypt.");
define ("_INVALIDEMAIL", "The e-mail address you supplied is an invalid format.");
define ("_LOGINAGAIN", "However, if you have changed your password, you will have to <a href=\"login.php\">login again</a>.");
define ("_NEWACCOUNT", "New Account");
--- a/user/editbio.php
+++ b/user/editbio.php
@@ -49,6 +49,16 @@
if((!isADMIN || uLEVEL > 2) && $uid != USERUID && $action == "editbio") $output .= write_error(_NOTAUTHORIZED);
if(isMEMBER) $output .= "<div id=\"pagetitle\">"._EDITPERSONAL."</div>";
else $output .= "<div id=\"pagetitle\">"._NEWACCOUNT."</div>";
+
+ // check for MD5 password hashes after a user logs in to edit their bio and warn them if their password is insecure
+ // all MD5 hashes are 32 exact characters long, hexadecimal, 0-9 and a-f random
+ // this set is a bit cursed... but it works
+ $pwdcharlengthquery = dbquery("SELECT CHAR_LENGTH(password) FROM ".TABLEPREFIX."fanfiction_authors WHERE uid = ".USERUID.";");
+ $pwdlengthfetch = mysqli_fetch_row($pwdcharlengthquery);
+ $pwdlengthstring = end($pwdlengthfetch);
+ $pwdcheck = (int) $pwdlengthstring;
+ if ($pwdcheck == 32) $output .= "<center>"._INSECUREPWD."</center><br>";
+
if(!empty($_POST['submit'])) {
$penname = isset($_POST['newpenname']) ? escapestring($_POST['newpenname']) : false;
$email = escapestring($_POST['email']);