maketank/Froxlor
2
0
Fork 0
Code Pull Requests Releases Activity

crypt() does not seem to like some special-characters in its salts, so we skip'em whenever we are generating a password as a salt-value, thx to Tobse101 for a nice debugging session ;)

Browse Source 
Signed-off-by: Michael Kaufmann (d00p) <d00p@froxlor.org>
This commit is contained in:
Michael Kaufmann (d00p)
2015-10-02 17:09:41 +02:00
parent 94b43021ff
commit be5a13fbb1
2 changed files with 17 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
lib/functions/froxlor/function.generatePassword.php
View File

@@ -17,39 +17,42 @@
/** /**
* Generates a random password * Generates a random password
*
* @param boolean $isSalt
* optional, create a hash for a salt used in makeCryptPassword because crypt() does not like some special characters in its salts, default is false
*/ */
function generatePassword() function generatePassword($isSalt = false)
{ {
$alpha_lower = 'abcdefghijklmnopqrstuvwxyz'; $alpha_lower = 'abcdefghijklmnopqrstuvwxyz';
$alpha_upper = strtoupper($alpha_lower); $alpha_upper = strtoupper($alpha_lower);
$numeric = '0123456789'; $numeric = '0123456789';
$special = Settings::Get('panel.password_special_char'); $special = Settings::Get('panel.password_special_char');
$length = Settings::Get('panel.password_min_length') > 3 ? Settings::Get('panel.password_min_length') : 10; $length = Settings::Get('panel.password_min_length') > 3 ? Settings::Get('panel.password_min_length') : 10;
$pw = special_shuffle($alpha_lower); $pw = special_shuffle($alpha_lower);
$n = floor(($length) / 4); $n = floor(($length) / 4);
if (Settings::Get('panel.password_alpha_upper')) { if (Settings::Get('panel.password_alpha_upper')) {
$pw .= mb_substr(special_shuffle($alpha_upper), 0, $n); $pw .= mb_substr(special_shuffle($alpha_upper), 0, $n);
} }
if (Settings::Get('panel.password_numeric')) { if (Settings::Get('panel.password_numeric')) {
$pw .= mb_substr(special_shuffle($numeric), 0, $n); $pw .= mb_substr(special_shuffle($numeric), 0, $n);
} }
if (Settings::Get('panel.password_special_char_required')) { if (Settings::Get('panel.password_special_char_required') && !$isSalt) {
$pw .= mb_substr(special_shuffle($special), 0, $n); $pw .= mb_substr(special_shuffle($special), 0, $n);
} }
$pw = mb_substr($pw, - $length); $pw = mb_substr($pw, - $length);
return special_shuffle($pw); return special_shuffle($pw);
} }
/** /**
* multibyte-character safe shuffle function * multibyte-character safe shuffle function
* *
* @param string $str * @param string $str
* *
* @return string * @return string
*/ */

10
lib/functions/system/function.makeCryptPassword.php
View File

@@ -43,25 +43,25 @@ function makeCryptPassword ($password) {
$cryptPassword = crypt($password); $cryptPassword = crypt($password);
break; break;
case 1: case 1:
$cryptPassword = crypt($password, '$1$' . generatePassword(). generatePassword()); $cryptPassword = crypt($password, '$1$' . generatePassword(true). generatePassword(true));
break; break;
case 2: case 2:
if (version_compare(phpversion(), '5.3.7', '<')) { if (version_compare(phpversion(), '5.3.7', '<')) {
$cryptPassword = crypt($password, '$2a$' . generatePassword(). generatePassword()); $cryptPassword = crypt($password, '$2a$' . generatePassword(true). generatePassword(true));
} else { } else {
// Blowfish hashing with a salt as follows: "$2a$", "$2x$" or "$2y$", // Blowfish hashing with a salt as follows: "$2a$", "$2x$" or "$2y$",
// a two digit cost parameter, "$", and 22 characters from the alphabet "./0-9A-Za-z" // a two digit cost parameter, "$", and 22 characters from the alphabet "./0-9A-Za-z"
$cryptPassword = crypt( $cryptPassword = crypt(
$password, $password,
'$2y$07$' . substr(generatePassword().generatePassword().generatePassword(), 0, 22) '$2y$07$' . substr(generatePassword(true).generatePassword(true).generatePassword(true), 0, 22)
); );
} }
break; break;
case 3: case 3:
$cryptPassword = crypt($password, '$5$' . generatePassword(). generatePassword()); $cryptPassword = crypt($password, '$5$' . generatePassword(true). generatePassword(true));
break; break;
case 4: case 4:
$cryptPassword = crypt($password, '$6$' . generatePassword(). generatePassword()); $cryptPassword = crypt($password, '$6$' . generatePassword(true). generatePassword(true));
break; break;
default: default:
$cryptPassword = crypt($password); $cryptPassword = crypt($password);