From 90d337a51f600581079945ad1772b6f681a79a81 Mon Sep 17 00:00:00 2001
From: Lars Jung <lrsjng@gmail.com>
Date: Wed, 6 May 2015 14:12:17 +0200
Subject: [PATCH] Change hash algo to sha512.

---
 src/_h5ai/server/php/config.php              | 6 +++---
 src/_h5ai/server/php/inc/class-api.php       | 2 +-
 src/_h5ai/server/php/inc/class-bootstrap.php | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/_h5ai/server/php/config.php b/src/_h5ai/server/php/config.php
index bc7ad83a..11267288 100644
--- a/src/_h5ai/server/php/config.php
+++ b/src/_h5ai/server/php/config.php
@@ -1,8 +1,8 @@
 <?php
 
 /*********************************************************************
-  SHA1 hash of the info page password, the preset password is the
+  SHA512 hash of the info page password, the preset password is the
   empty string. You might change it to keep this information private.
-  Online hash generator: http://www.sha1.cz/
+  Online hash generator: http://md5hashing.net/hashing/sha512
 *********************************************************************/
-define("PASSHASH", "da39a3ee5e6b4b0d3255bfef95601890afd80709");
+define("PASSHASH", "cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e");
diff --git a/src/_h5ai/server/php/inc/class-api.php b/src/_h5ai/server/php/inc/class-api.php
index 0dc3ae37..a69fa32d 100644
--- a/src/_h5ai/server/php/inc/class-api.php
+++ b/src/_h5ai/server/php/inc/class-api.php
@@ -25,7 +25,7 @@ class Api {
     private function on_login() {
 
         $pass = Util::get_request_param("pass");
-        $_SESSION[AS_ADMIN_SESSION_KEY] = sha1($pass) === PASSHASH;
+        $_SESSION[AS_ADMIN_SESSION_KEY] = strcasecmp(hash("sha512", $pass), PASSHASH) === 0;
         Util::json_exit(["asAdmin" => $_SESSION[AS_ADMIN_SESSION_KEY]]);
     }
 
diff --git a/src/_h5ai/server/php/inc/class-bootstrap.php b/src/_h5ai/server/php/inc/class-bootstrap.php
index b976611d..9122b852 100644
--- a/src/_h5ai/server/php/inc/class-bootstrap.php
+++ b/src/_h5ai/server/php/inc/class-bootstrap.php
@@ -55,7 +55,7 @@ class Bootstrap {
         session_start();
         define("AS_ADMIN_SESSION_KEY", "__H5AI_AS_ADMIN__");
         define("AS_ADMIN", isset($_SESSION[AS_ADMIN_SESSION_KEY]) && $_SESSION[AS_ADMIN_SESSION_KEY] === true);
-        define("HAS_CUSTOM_PASSHASH", PASSHASH !== "da39a3ee5e6b4b0d3255bfef95601890afd80709");
+        define("HAS_CUSTOM_PASSHASH", strcasecmp(PASSHASH, "cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e") !== 0);
     }