From 290c436046327d9f04b7d12b5fda19f4dc14f574 Mon Sep 17 00:00:00 2001 From: Denis Date: Mon, 5 Apr 2010 09:41:30 -0400 Subject: Support for storing salted passwords To upgrade existing databases: ALTER TABLE Users ADD Salt CHAR(32) NOT NULL DEFAULT ''; Signed-off-by: Loui Chang --- web/html/passreset.php | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'web/html/passreset.php') diff --git a/web/html/passreset.php b/web/html/passreset.php index 6fbd1caa..0f98593d 100644 --- a/web/html/passreset.php +++ b/web/html/passreset.php @@ -31,10 +31,13 @@ if (isset($_GET['resetkey'], $_POST['email'], $_POST['password'], $_POST['confir if (empty($error)) { $dbh = db_connect(); + $salt = generate_salt(); + $hash = salted_hash($password, $salt); # The query below won't affect any records unless the ResetKey # and Email combination is correct and ResetKey is nonempty $q = "UPDATE Users - SET Passwd = '".md5($password)."', + SET Passwd = '$hash', + Salt = '$salt', ResetKey = '' WHERE ResetKey != '' AND ResetKey = '".mysql_real_escape_string($resetkey)."' -- cgit v1.2.3-24-g4f1b