Merge pull request hestiacp#2397 from jaapmarcus/fix/block-yesscrypt-attempts-valid

Add warning if user tries to login with yesscrypt  hashed password

Author: ScIT-Raphael

bin/v-check-user-password

@@ -62,7 +62,10 @@ if echo "$shadow" | grep -qE '^\$[0-9a-z]+\$[^\$]+\$'
 then
     salt=$(echo "$shadow" |cut -f 3 -d \$)
     method=$(echo "$shadow" |cut -f 2 -d \$)
-    if [ "$method" -eq '1' ]; then
+    if [ "$method" = "y" ]; then
+        echo "Unsuported hash method";
+        exit 1;   
+    elif [ "$method" -eq '1' ]; then
         method='md5'
     elif [ "$method" -eq '6' ]; then
         method='sha-512'

web/login/index.php

@@ -107,6 +107,8 @@ function authenticate_user($user, $password, $twofa = '')
             sleep(2);
             if($return_var == 5){
                 $error = '<a class="error">' . _('Account has been suspended') . '</a>';   
+            }elseif($return_var == 1){
+                $error = '<a class="error">' . _('Unsuported hash method') . '</a>';     
             }else{
                 $error = '<a class="error">' . _('Invalid username or password') . '</a>';    
             }