makary/phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-06-08 04:18:52 +00:00
Code Issues Projects Releases Packages Wiki Activity

[ticket/17351] Correctly handle md5 passwords rehashing

Browse source 
PHPBB-17351
This commit is contained in:
rxu 2024-06-28 11:08:46 +07:00
parent 3647cf2cfe
commit e5d2e82ef5
No known key found for this signature in database
GPG key ID: 8117904FEDEFDD17
2 changed files with 18 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
phpBB/phpbb/console/command/fixup/update_hashes.php
View file

@ -100,7 +100,15 @@ class update_hashes extends \phpbb\console\command\command
while ($row = $this->db->sql_fetchrow($result)) while ($row = $this->db->sql_fetchrow($result))
{ {
$old_hash = preg_replace('/^\$CP\$/', '', $row['user_password']); $old_hash = preg_replace('/^\$CP\$/', '', $row['user_password']);
$new_hash = $this->passwords_manager->hash($old_hash, array($this->default_type));
// If stored hash type is unknown then it's md5 hash with no prefix
// First rehash it using $H$ as hash type identifier (salted_md5)
if (!$this->passwords_manager->detect_algorithm($old_hash))
{
$old_hash = $this->passwords_manager->hash($old_hash, '$H$');
}
$new_hash = $this->passwords_manager->hash($old_hash, [$this->default_type]);
$sql = 'UPDATE ' . USERS_TABLE . " $sql = 'UPDATE ' . USERS_TABLE . "
SET user_password = '" . $this->db->sql_escape($new_hash) . "' SET user_password = '" . $this->db->sql_escape($new_hash) . "'

10
phpBB/phpbb/cron/task/core/update_hashes.php
View file

@ -107,7 +107,15 @@ class update_hashes extends \phpbb\cron\task\base
while ($row = $this->db->sql_fetchrow($result)) while ($row = $this->db->sql_fetchrow($result))
{ {
$old_hash = preg_replace('/^\$CP\$/', '', $row['user_password']); $old_hash = preg_replace('/^\$CP\$/', '', $row['user_password']);
$new_hash = $this->passwords_manager->hash($old_hash, array($this->default_type));
// If stored hash type is unknown then it's md5 hash with no prefix
// First rehash it using $H$ as hash type identifier (salted_md5)
if (!$this->passwords_manager->detect_algorithm($old_hash))
{
$old_hash = $this->passwords_manager->hash($old_hash, '$H$');
}
$new_hash = $this->passwords_manager->hash($old_hash, [$this->default_type]);
// Increase number so we know that users were selected from the database // Increase number so we know that users were selected from the database
$affected_rows++; $affected_rows++;