makary/phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-06-11 05:48:51 +00:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #6659 from rxu/ticket/17351-master

Browse source 
[ticket/17351] Correctly handle md5 passwords rehashing - master
This commit is contained in:
Marc Alexander 2024-06-30 12:40:20 +02:00
commit 13f2f44825
No known key found for this signature in database
GPG key ID: 50E0D2423696F995
2 changed files with 16 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
phpBB/phpbb/console/command/fixup/update_hashes.php
View file

@ -101,6 +101,14 @@ class update_hashes extends \phpbb\console\command\command
while ($row = $this->db->sql_fetchrow($result)) while ($row = $this->db->sql_fetchrow($result))
{ {
$old_hash = preg_replace('/^\$CP\$/', '', $row['user_password']); $old_hash = preg_replace('/^\$CP\$/', '', $row['user_password']);
// If stored hash type is unknown then it's md5 hash with no prefix
// First rehash it using $H$ as hash type identifier (salted_md5)
if (!$this->passwords_manager->detect_algorithm($old_hash))
{
$old_hash = $this->passwords_manager->hash($old_hash, '$H$');
}
$new_hash = $this->passwords_manager->hash($old_hash, [$this->default_type]); $new_hash = $this->passwords_manager->hash($old_hash, [$this->default_type]);
$sql = 'UPDATE ' . USERS_TABLE . " $sql = 'UPDATE ' . USERS_TABLE . "

8
phpBB/phpbb/cron/task/core/update_hashes.php
View file

@ -107,6 +107,14 @@ class update_hashes extends \phpbb\cron\task\base
while ($row = $this->db->sql_fetchrow($result)) while ($row = $this->db->sql_fetchrow($result))
{ {
$old_hash = preg_replace('/^\$CP\$/', '', $row['user_password']); $old_hash = preg_replace('/^\$CP\$/', '', $row['user_password']);
// If stored hash type is unknown then it's md5 hash with no prefix
// First rehash it using $H$ as hash type identifier (salted_md5)
if (!$this->passwords_manager->detect_algorithm($old_hash))
{
$old_hash = $this->passwords_manager->hash($old_hash, '$H$');
}
$new_hash = $this->passwords_manager->hash($old_hash, [$this->default_type]); $new_hash = $this->passwords_manager->hash($old_hash, [$this->default_type]);
// Increase number so we know that users were selected from the database // Increase number so we know that users were selected from the database