makary/phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-06-08 04:18:52 +00:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #6658 from rxu/ticket/17351

Browse source 
[ticket/17351] Correctly handle md5 passwords rehashing - 3.3.x
This commit is contained in:
Marc Alexander 2024-06-30 12:39:48 +02:00
commit ad77f0d0ab
No known key found for this signature in database
GPG key ID: 50E0D2423696F995
2 changed files with 18 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
phpBB/phpbb/console/command/fixup/update_hashes.php
View file

@ -100,7 +100,15 @@ class update_hashes extends \phpbb\console\command\command
while ($row = $this->db->sql_fetchrow($result)) while ($row = $this->db->sql_fetchrow($result))
{ {
$old_hash = preg_replace('/^\$CP\$/', '', $row['user_password']); $old_hash = preg_replace('/^\$CP\$/', '', $row['user_password']);
$new_hash = $this->passwords_manager->hash($old_hash, array($this->default_type));
// If stored hash type is unknown then it's md5 hash with no prefix
// First rehash it using $H$ as hash type identifier (salted_md5)
if (!$this->passwords_manager->detect_algorithm($old_hash))
{
$old_hash = $this->passwords_manager->hash($old_hash, '$H$');
}
$new_hash = $this->passwords_manager->hash($old_hash, [$this->default_type]);
$sql = 'UPDATE ' . USERS_TABLE . " $sql = 'UPDATE ' . USERS_TABLE . "
SET user_password = '" . $this->db->sql_escape($new_hash) . "' SET user_password = '" . $this->db->sql_escape($new_hash) . "'

10
phpBB/phpbb/cron/task/core/update_hashes.php
View file

@ -107,7 +107,15 @@ class update_hashes extends \phpbb\cron\task\base
while ($row = $this->db->sql_fetchrow($result)) while ($row = $this->db->sql_fetchrow($result))
{ {
$old_hash = preg_replace('/^\$CP\$/', '', $row['user_password']); $old_hash = preg_replace('/^\$CP\$/', '', $row['user_password']);
$new_hash = $this->passwords_manager->hash($old_hash, array($this->default_type));
// If stored hash type is unknown then it's md5 hash with no prefix
// First rehash it using $H$ as hash type identifier (salted_md5)
if (!$this->passwords_manager->detect_algorithm($old_hash))
{
$old_hash = $this->passwords_manager->hash($old_hash, '$H$');
}
$new_hash = $this->passwords_manager->hash($old_hash, [$this->default_type]);
// Increase number so we know that users were selected from the database // Increase number so we know that users were selected from the database
$affected_rows++; $affected_rows++;