Skip to content

Commit 2d6d9eb

Browse files
author
Marius Burkard
committed
- Support CRYPT-SHA512 and SHA256 for passwords, implements #5353
1 parent f343e16 commit 2d6d9eb

File tree

7 files changed

+49
-49
lines changed

7 files changed

+49
-49
lines changed

‎install/sql/incremental/upd_dev_collection.sql‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
ALTER TABLE `client` CHANGE COLUMN `password` `password` VARCHAR(200) DEFAULT NULL;
2+
ALTER TABLE `ftp_user` CHANGE COLUMN `password` `password` VARCHAR(200) DEFAULT NULL;
3+
ALTER TABLE `shell_user` CHANGE COLUMN `password` `password` VARCHAR(200) DEFAULT NULL;
4+
ALTER TABLE `sys_user` CHANGE COLUMN `passwort` `passwort` VARCHAR(200) DEFAULT NULL;
5+
ALTER TABLE `webdav_user` CHANGE COLUMN `password` `password` VARCHAR(200) DEFAULT NULL;

‎install/sql/ispconfig3.sql‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -243,7 +243,7 @@ CREATE TABLE `client` (
243243
`limit_openvz_vm_template_id` int(11) NOT NULL DEFAULT '0',
244244
`parent_client_id` int(11) unsigned NOT NULL DEFAULT '0',
245245
`username` varchar(64) DEFAULT NULL,
246-
`password` varchar(64) DEFAULT NULL,
246+
`password` varchar(200) DEFAULT NULL,
247247
`language` char(2) NOT NULL DEFAULT 'en',
248248
`usertheme` varchar(32) NOT NULL DEFAULT 'default',
249249
`template_master` int(11) unsigned NOT NULL DEFAULT '0',
@@ -705,7 +705,7 @@ CREATE TABLE `ftp_user` (
705705
`parent_domain_id` int(11) unsigned NOT NULL default '0',
706706
`username` varchar(64) default NULL,
707707
`username_prefix` varchar(50) NOT NULL default '',
708-
`password` varchar(64) default NULL,
708+
`password` varchar(200) default NULL,
709709
`quota_size` bigint(20) NOT NULL default '-1',
710710
`active` enum('n','y') NOT NULL default 'y',
711711
`uid` varchar(64) default NULL,
@@ -1440,7 +1440,7 @@ CREATE TABLE `shell_user` (
14401440
`parent_domain_id` int(11) unsigned NOT NULL default '0',
14411441
`username` varchar(64) default NULL,
14421442
`username_prefix` varchar(50) NOT NULL default '',
1443-
`password` varchar(64) default NULL,
1443+
`password` varchar(200) default NULL,
14441444
`quota_size` bigint(20) NOT NULL default '-1',
14451445
`active` enum('n','y') NOT NULL default 'y',
14461446
`puser` varchar(255) default NULL,
@@ -1864,7 +1864,7 @@ CREATE TABLE `sys_user` (
18641864
`sys_perm_group` varchar(5) NOT NULL default 'riud',
18651865
`sys_perm_other` varchar(5) NOT NULL default '',
18661866
`username` varchar(64) NOT NULL default '',
1867-
`passwort` varchar(64) NOT NULL default '',
1867+
`passwort` varchar(200) NOT NULL default '',
18681868
`modules` varchar(255) NOT NULL default '',
18691869
`startmodule` varchar(255) NOT NULL default '',
18701870
`app_theme` varchar(32) NOT NULL default 'default',
@@ -1899,7 +1899,7 @@ CREATE TABLE `webdav_user` (
18991899
`parent_domain_id` int(11) unsigned NOT NULL DEFAULT '0',
19001900
`username` varchar(64) DEFAULT NULL,
19011901
`username_prefix` varchar(50) NOT NULL default '',
1902-
`password` varchar(64) DEFAULT NULL,
1902+
`password` varchar(200) DEFAULT NULL,
19031903
`active` enum('n','y') NOT NULL DEFAULT 'y',
19041904
`dir` varchar(255) DEFAULT NULL,
19051905
PRIMARY KEY (`webdav_user_id`)

‎interface/lib/classes/auth.inc.php‎

Lines changed: 20 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -231,12 +231,27 @@ public function crypt_password($cleartext_password, $charset = 'UTF-8') {
231231
if($charset != 'UTF-8') {
232232
$cleartext_password = mb_convert_encoding($cleartext_password, $charset, 'UTF-8');
233233
}
234-
$salt="$1$";
235-
$base64_alphabet='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
236-
for ($n=0;$n<8;$n++) {
237-
$salt.=$base64_alphabet[mt_rand(0, 63)];
234+
235+
if(defined('CRYPT_SHA512') && CRYPT_SHA512 == 1) {
236+
$salt = '$6$rounds=5000$';
237+
$salt_length = 16;
238+
} elseif(defined('CRYPT_SHA256') && CRYPT_SHA256 == 1) {
239+
$salt = '$5$rounds=5000$';
240+
$salt_length = 16;
241+
} else {
242+
$salt = '$1$';
243+
$salt_length = 12;
244+
}
245+
246+
if(function_exists('openssl_random_pseudo_bytes')) {
247+
$salt .= substr(bin2hex(openssl_random_pseudo_bytes($salt_length)), 0, $salt_length);
248+
} else {
249+
$base64_alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789./';
250+
for($n = 0; $n < $salt_length; $n++) {
251+
$salt .= $base64_alphabet[mt_rand(0, 63)];
252+
}
238253
}
239-
$salt.="$";
254+
$salt .= "$";
240255
return crypt($cleartext_password, $salt);
241256
}
242257

‎interface/lib/classes/remote.d/client.inc.php‎

Lines changed: 5 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -604,11 +604,9 @@ public function client_login_get($session_id,$username,$password,$remote_ip = ''
604604
if($user) {
605605
$saved_password = stripslashes($user['password']);
606606

607-
if(substr($saved_password, 0, 3) == '$1$') {
608-
//* The password is crypt-md5 encrypted
609-
$salt = '$1$'.substr($saved_password, 3, 8).'$';
610-
611-
if(crypt(stripslashes($password), $salt) != $saved_password) {
607+
if(preg_match('/^\$[156]\$/', $saved_password)) {
608+
//* The password is crypt encrypted
609+
if(crypt(stripslashes($password), $saved_password) !== $saved_password) {
612610
$user = false;
613611
}
614612
} else {
@@ -636,11 +634,9 @@ public function client_login_get($session_id,$username,$password,$remote_ip = ''
636634
if($user) {
637635
$saved_password = stripslashes($user['passwort']);
638636

639-
if(substr($saved_password, 0, 3) == '$1$') {
637+
if(preg_match('/^\$[156]\$/', $saved_password)) {
640638
//* The password is crypt-md5 encrypted
641-
$salt = '$1$'.substr($saved_password, 3, 8).'$';
642-
643-
if(crypt(stripslashes($password), $salt) != $saved_password) {
639+
if(crypt(stripslashes($password), $saved_password) != $saved_password) {
644640
$user = false;
645641
}
646642
} else {

‎interface/lib/classes/remoting.inc.php‎

Lines changed: 2 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -99,28 +99,22 @@ public function login($username, $password, $client_login = false)
9999
if($user) {
100100
$saved_password = stripslashes($user['passwort']);
101101

102-
if(substr($saved_password, 0, 3) == '$1$') {
102+
if(preg_match('/^\$[156]\$/', $saved_password)) {
103103
//* The password is crypt-md5 encrypted
104-
$salt = '$1$'.substr($saved_password, 3, 8).'$';
105-
106-
if(crypt(stripslashes($password), $salt) != $saved_password) {
104+
if(crypt(stripslashes($password), $saved_password) != $saved_password) {
107105
throw new SoapFault('client_login_failed', 'The login failed. Username or password wrong.');
108-
return false;
109106
}
110107
} else {
111108
//* The password is md5 encrypted
112109
if(md5($password) != $saved_password) {
113110
throw new SoapFault('client_login_failed', 'The login failed. Username or password wrong.');
114-
return false;
115111
}
116112
}
117113
} else {
118114
throw new SoapFault('client_login_failed', 'The login failed. Username or password wrong.');
119-
return false;
120115
}
121116
if($user['active'] != 1) {
122117
throw new SoapFault('client_login_failed', 'The login failed. User is blocked.');
123-
return false;
124118
}
125119

126120
// now we need the client data

‎interface/web/admin/users_edit.php‎

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -104,6 +104,8 @@ function onBeforeUpdate() {
104104
function onAfterUpdate() {
105105
global $app, $conf;
106106

107+
$app->uses('auth');
108+
107109
$client = $app->db->queryOneRecord("SELECT * FROM sys_user WHERE userid = ?", $this->id);
108110
$client_id = $app->functions->intval($client['client_id']);
109111
$username = $this->dataRecord["username"];
@@ -121,13 +123,7 @@ function onAfterUpdate() {
121123
// password changed
122124
if(isset($conf['demo_mode']) && $conf['demo_mode'] != true && isset($this->dataRecord["passwort"]) && $this->dataRecord["passwort"] != '') {
123125
$password = $this->dataRecord["passwort"];
124-
$salt="$1$";
125-
$base64_alphabet='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
126-
for ($n=0;$n<8;$n++) {
127-
$salt.=$base64_alphabet[mt_rand(0, 63)];
128-
}
129-
$salt.="$";
130-
$password = crypt(stripslashes($password), $salt);
126+
$password = $app->auth->crypt_password($password);
131127
$sql = "UPDATE client SET password = ? WHERE client_id = ? AND username = ?";
132128
$app->db->query($sql, $password, $client_id, $username);
133129
}

‎interface/web/client/reseller_edit.php‎

Lines changed: 9 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -200,6 +200,9 @@ function onShowEnd() {
200200
*/
201201
function onAfterInsert() {
202202
global $app, $conf;
203+
204+
$app->uses('auth');
205+
203206
// Create the group for the reseller
204207
$groupid = $app->db->datalogInsert('sys_group', array("name" => $this->dataRecord["username"], "description" => '', "client_id" => $this->id), 'groupid');
205208
$groups = $groupid;
@@ -213,14 +216,8 @@ function onAfterInsert() {
213216
$active = 1;
214217
$language = $this->dataRecord["language"];
215218

216-
$salt="$1$";
217-
$base64_alphabet='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
218-
for ($n=0;$n<8;$n++) {
219-
$salt.=$base64_alphabet[mt_rand(0, 63)];
220-
}
221-
$salt.="$";
222-
$password = crypt(stripslashes($password), $salt);
223-
219+
$password = $app->auth->crypt_password(stripslashes($password));
220+
224221
// Create the controlpaneluser for the reseller
225222
$sql = "INSERT INTO sys_user (`username`,`passwort`,`modules`,`startmodule`,`app_theme`,`typ`, `active`,`language`,`groups`,`default_group`,`client_id`)
226223
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)";
@@ -313,6 +310,8 @@ function onAfterInsert() {
313310
function onAfterUpdate() {
314311
global $app, $conf;
315312

313+
$app->uses('auth');
314+
316315
// username changed
317316
if(isset($conf['demo_mode']) && $conf['demo_mode'] != true && isset($this->dataRecord['username']) && $this->dataRecord['username'] != '' && $this->oldDataRecord['username'] != $this->dataRecord['username']) {
318317
$username = $this->dataRecord["username"];
@@ -329,13 +328,8 @@ function onAfterUpdate() {
329328
if(isset($conf['demo_mode']) && $conf['demo_mode'] != true && isset($this->dataRecord["password"]) && $this->dataRecord["password"] != '') {
330329
$password = $this->dataRecord["password"];
331330
$client_id = $this->id;
332-
$salt="$1$";
333-
$base64_alphabet='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
334-
for ($n=0;$n<8;$n++) {
335-
$salt.=$base64_alphabet[mt_rand(0, 63)];
336-
}
337-
$salt.="$";
338-
$password = crypt(stripslashes($password), $salt);
331+
332+
$password = $app->auth->crypt_password(stripslashes($password));
339333
$sql = "UPDATE sys_user SET passwort = ? WHERE client_id = ?";
340334
$app->db->query($sql, $password, $client_id);
341335
}

0 commit comments

Comments
 (0)