Stop ever using perl's crypt() function; only use mysql's. (Using

both was causing corruption on about 1 in 40 passwords.)

1 files changed, 4 insertions, 1 deletions

diff --git a/CGI.pl b/CGI.pl
index 41667dd2c..5f7a21f88 100644
--- a/CGI.pl
+++ b/CGI.pl
@@ -604,7 +604,10 @@ sub confirm_login {
             exit;
         }
 
-	my $enteredcryptpwd = crypt($enteredpwd, substr($realcryptpwd, 0, 2));
+        SendSQL("SELECT encrypt(" . SqlQuote($enteredpwd) . ", " .
+                SqlQuote(substr($realcryptpwd, 0, 2)) . ")");
+        my $enteredcryptpwd = FetchOneColumn();
+
         if ($realcryptpwd eq "" || $enteredcryptpwd ne $realcryptpwd) {
             print "Content-type: text/html\n\n";
 	    PutHeader("Login failed");