mirror/php-phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-03-14 04:30:29 +01:00
Code Issues Releases Wiki Activity

Merge branch '3.3.x'

Browse Source
This commit is contained in:
Máté Bartus 2021-02-05 18:03:51 +01:00
commit de711bb7c0
3 changed files with 18 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
phpBB/phpbb/console/command/fixup/update_hashes.php
View File

@ -99,7 +99,8 @@ class update_hashes extends \phpbb\console\command\command
while ($row = $this->db->sql_fetchrow($result))
{
$new_hash = $this->passwords_manager->hash($row['user_password'], array($this->default_type));
$old_hash = preg_replace('/^\$CP\$/', '', $row['user_password']);
$new_hash = $this->passwords_manager->hash($old_hash, array($this->default_type));
$sql = 'UPDATE ' . USERS_TABLE . "
SET user_password = '" . $this->db->sql_escape($new_hash) . "'

3
phpBB/phpbb/cron/task/core/update_hashes.php
View File

@ -106,7 +106,8 @@ class update_hashes extends \phpbb\cron\task\base
while ($row = $this->db->sql_fetchrow($result))
{
$new_hash = $this->passwords_manager->hash($row['user_password'], array($this->default_type));
$old_hash = preg_replace('/^\$CP\$/', '', $row['user_password']);
$new_hash = $this->passwords_manager->hash($old_hash, array($this->default_type));
// Increase number so we know that users were selected from the database
$affected_rows++;

16
phpBB/phpbb/passwords/manager.php
View File

@ -382,11 +382,22 @@ class manager
* @param array $stored_hash_type An array containing the hash types
* as described by stored password hash
* @param string $hash Stored password hash
* @param bool $skip_phpbb2_check True if phpBB2 password check should be skipped
*
* @return bool True if password is correct, false if not
*/
public function check_combined_hash($password, $stored_hash_type, $hash)
public function check_combined_hash($password, $stored_hash_type, $hash, bool $skip_phpbb2_check = false)
{
// Special case for passwords converted from phpBB2:
// These could be phpass(md5(password)) and hence already be double
// hashed. For these, try to also check combined hash output of
// md5 version of supplied password.
$is_valid_phpbb2_pass = false;
if (!$skip_phpbb2_check)
{
$is_valid_phpbb2_pass = $this->check_combined_hash(md5($password), $stored_hash_type, $hash, true);
}
$i = 0;
$data = array(
'prefix' => '$',
@ -402,6 +413,7 @@ class manager
$password = str_replace($rebuilt_hash, '', $cur_hash);
$i++;
}
return ($hash === $this->helper->combine_hash_output($data, 'hash', $password));
return hash_equals($hash, $this->helper->combine_hash_output($data, 'hash', $password)) || $is_valid_phpbb2_pass;
}
}