From fb045c3fe1acaf9f2119c1b100aac52977bb4f12 Mon Sep 17 00:00:00 2001 From: "Michael Kaufmann (d00p)" Date: Sun, 14 Apr 2013 18:41:21 +0200 Subject: [PATCH] let admin chose what password-hash-algorithm is to be used to crypt() passwords; fixes #852 Signed-off-by: Michael Kaufmann (d00p) --- actions/admin/settings/210.security.php | 18 +++++-- admin_customers.php | 2 +- customer_email.php | 4 +- customer_ftp.php | 4 +- customer_index.php | 2 +- install/froxlor.sql | 1 + .../updates/froxlor/0.9/update_0.9.inc.php | 2 + .../system/function.makeCryptPassword.php | 51 ++++++++++--------- lng/english.lng.php | 2 + lng/german.lng.php | 2 + 10 files changed, 52 insertions(+), 36 deletions(-) diff --git a/actions/admin/settings/210.security.php b/actions/admin/settings/210.security.php index c6ba1af7..cd478cd0 100644 --- a/actions/admin/settings/210.security.php +++ b/actions/admin/settings/210.security.php @@ -38,9 +38,17 @@ return array( 'default' => true, 'save_method' => 'storeSettingField', ), - ), - ), - ), + 'system_passwordcryptfunc' => array( + 'label' => $lng['serversettings']['passwordcryptfunc'], + 'settinggroup' => 'system', + 'varname' => 'passwordcryptfunc', + 'type' => 'option', + 'default' => 0, + 'option_mode' => 'one', + 'option_options' => array(0 => $lng['serversettings']['systemdefault'], 1 => 'MD5', 2 => 'BLOWFISH', 3 => 'SHA-256', 4 => 'SHA-512'), + 'save_method' => 'storeSettingField', + ) + ) + ) + ) ); - -?> \ No newline at end of file diff --git a/admin_customers.php b/admin_customers.php index e3ad71a7..0312a11e 100644 --- a/admin_customers.php +++ b/admin_customers.php @@ -789,7 +789,7 @@ if($page == 'customers' } inserttask('1'); - $cryptPassword = makeCryptPassword($password ,1); + $cryptPassword = makeCryptPassword($password); $result = $db->query("INSERT INTO `" . TABLE_FTP_USERS . "` " . "(`customerid`, `username`, `password`, `homedir`, `login_enabled`, `uid`, `gid`) " . "VALUES ('" . (int)$customerid . "', '" . $db->escape($loginname) . "', '" . $db->escape($cryptPassword) . "', '" . $db->escape($documentroot) . "', 'y', '" . (int)$guid . "', '" . (int)$guid . "')"); $result = $db->query("INSERT INTO `" . TABLE_FTP_GROUPS . "` " . "(`customerid`, `groupname`, `gid`, `members`) " . "VALUES ('" . (int)$customerid . "', '" . $db->escape($loginname) . "', '" . $db->escape($guid) . "', '" . $db->escape($loginname) . "')"); $result = $db->query("INSERT INTO `" . TABLE_FTP_QUOTATALLIES . "` (`name`, `quota_type`, `bytes_in_used`, `bytes_out_used`, `bytes_xfer_used`, `files_in_used`, `files_out_used`, `files_xfer_used`) VALUES ('" . $db->escape($loginname) . "', 'user', '0', '0', '0', '0', '0', '0')"); diff --git a/customer_email.php b/customer_email.php index 450a9259..657ab93f 100644 --- a/customer_email.php +++ b/customer_email.php @@ -458,7 +458,7 @@ elseif($page == 'accounts') $password = substr(md5(uniqid(microtime(), 1)), 12, 6); } - $cryptPassword = makeCryptPassword($password, 1); + $cryptPassword = makeCryptPassword($password); $email_user=substr($email_full,0,strrpos($email_full,"@")); $email_domain=substr($email_full,strrpos($email_full,"@")+1); @@ -607,7 +607,7 @@ elseif($page == 'accounts') $password = validatePassword($password); $log->logAction(USR_ACTION, LOG_NOTICE, "changed email password for '" . $result['email_full'] . "'"); - $cryptPassword = makeCryptPassword($password,1); + $cryptPassword = makeCryptPassword($password); $result = $db->query("UPDATE `" . TABLE_MAIL_USERS . "` SET " . ($settings['system']['mailpwcleartext'] == '1' ? "`password` = '" . $db->escape($password) . "', " : '') . " `password_enc`='" . $db->escape($cryptPassword) . "' WHERE `customerid`='" . (int)$userinfo['customerid'] . "' AND `id`='" . (int)$result['popaccountid'] . "'"); redirectTo($filename, Array('page' => 'emails', 'action' => 'edit', 'id' => $id, 's' => $s)); } diff --git a/customer_ftp.php b/customer_ftp.php index ba40a138..cafe5370 100644 --- a/customer_ftp.php +++ b/customer_ftp.php @@ -188,7 +188,7 @@ elseif($page == 'accounts') { $path = makeCorrectDir($userinfo['documentroot'] . '/' . $path); - $cryptPassword = makeCryptPassword($password, 1); + $cryptPassword = makeCryptPassword($password); $db->query("INSERT INTO `" . TABLE_FTP_USERS . "` (`customerid`, `username`, `password`, `homedir`, `login_enabled`, `uid`, `gid`) VALUES ('" . (int)$userinfo['customerid'] . "', '" . $db->escape($username) . "', '" . $db->escape($cryptPassword) . "', '" . $db->escape($path) . "', 'y', '" . (int)$userinfo['guid'] . "', '" . (int)$userinfo['guid'] . "')"); $result = $db->query("SELECT `bytes_in_used` FROM `" . TABLE_FTP_QUOTATALLIES . "` WHERE `name` = '" . $userinfo['loginname'] . "'"); while($row = $db->fetch_array($result)) @@ -312,7 +312,7 @@ elseif($page == 'accounts') else { $log->logAction(USR_ACTION, LOG_INFO, "updated ftp-account password for '" . $result['username'] . "'"); - $cryptPassword = makeCryptPassword($password, 1); + $cryptPassword = makeCryptPassword($password); $db->query("UPDATE `" . TABLE_FTP_USERS . "` SET `password`='" . $db->escape($cryptPassword) . "' WHERE `customerid`='" . (int)$userinfo['customerid'] . "' AND `id`='" . (int)$id . "'"); // also update customers backup user password if password of main ftp user is changed diff --git a/customer_index.php b/customer_index.php index 78b3b778..9ca503a9 100644 --- a/customer_index.php +++ b/customer_index.php @@ -124,7 +124,7 @@ elseif($page == 'change_password') if(isset($_POST['change_main_ftp']) && $_POST['change_main_ftp'] == 'true') { - $cryptPassword = makeCryptPassword($new_password, 1); + $cryptPassword = makeCryptPassword($new_password); $db->query("UPDATE `" . TABLE_FTP_USERS . "` SET `password`='" . $db->escape($cryptPassword) . "' WHERE `customerid`='" . (int)$userinfo['customerid'] . "' AND `username`='" . $db->escape($userinfo['loginname']) . "'"); $log->logAction(USR_ACTION, LOG_NOTICE, 'changed main ftp password'); } diff --git a/install/froxlor.sql b/install/froxlor.sql index 64229daf..4c947455 100644 --- a/install/froxlor.sql +++ b/install/froxlor.sql @@ -510,6 +510,7 @@ INSERT INTO `panel_settings` (`settinggroup`, `varname`, `value`) VALUES ('system', 'phpreload_command', ''), ('system', 'apache24', '0'), ('system', 'documentroot_use_default_value', '0'), + ('system', 'passwordcryptfunc', '1'), ('panel', 'decimal_places', '4'), ('panel', 'adminmail', 'admin@SERVERNAME'), ('panel', 'phpmyadmin_url', ''), diff --git a/install/updates/froxlor/0.9/update_0.9.inc.php b/install/updates/froxlor/0.9/update_0.9.inc.php index 8e5f321f..f837cbf2 100644 --- a/install/updates/froxlor/0.9/update_0.9.inc.php +++ b/install/updates/froxlor/0.9/update_0.9.inc.php @@ -2062,5 +2062,7 @@ if(isFroxlorVersion('0.9.28.1')) { $db->query("INSERT INTO `panel_settings` (`settinggroup`, `varname`, `value`) VALUES ('panel', 'phpconfigs_hidestdsubdomain', '".$hide_stdsubdomains."');"); lastStepStatus(0); + // don't advertise security questions - just set a default silently + $db->query("INSERT INTO `panel_settings` (`settinggroup`, `varname`, `value`) VALUES ('system', 'passwordcryptfunc', '1');"); updateToVersion('0.9.29-dev1'); } \ No newline at end of file diff --git a/lib/functions/system/function.makeCryptPassword.php b/lib/functions/system/function.makeCryptPassword.php index 16c4cfcd..b316345e 100644 --- a/lib/functions/system/function.makeCryptPassword.php +++ b/lib/functions/system/function.makeCryptPassword.php @@ -18,7 +18,6 @@ /** * Make crypted password from clear text password * @param string Password to be crypted - * @param int Type of algorithm * @return string encrypted password * * @author Michal Wojcik @@ -30,29 +29,31 @@ * 4 - SHA-512 $6$ */ -function makeCryptPassword ($password, $type = 0) -{ - switch($type) - { - case 0: - $cryptPassword = crypt($password); - break; - case 1: - $cryptPassword = crypt($password, '$1$' . generatePassword(). generatePassword()); - break; - case 2: - $cryptPassword = crypt($password, '$2a$' . generatePassword(). generatePassword()); - break; - case 3: - $cryptPassword = crypt($password, '$5$' . generatePassword(). generatePassword()); - break; - case 4: - $cryptPassword = crypt($password, '$6$' . generatePassword(). generatePassword()); - break; - default: - $cryptPassword = crypt($password); - break; - } +function makeCryptPassword ($password) { - return ($cryptPassword); + global $settings; + + $type = isset($settings['system']['passwordcryptfunc']) ? (int)$settings['system']['passwordcryptfunc'] : 1; + + switch ($type) { + case 0: + $cryptPassword = crypt($password); + break; + case 1: + $cryptPassword = crypt($password, '$1$' . generatePassword(). generatePassword()); + break; + case 2: + $cryptPassword = crypt($password, '$2a$' . generatePassword(). generatePassword()); + break; + case 3: + $cryptPassword = crypt($password, '$5$' . generatePassword(). generatePassword()); + break; + case 4: + $cryptPassword = crypt($password, '$6$' . generatePassword(). generatePassword()); + break; + default: + $cryptPassword = crypt($password); + break; + } + return $cryptPassword; } diff --git a/lng/english.lng.php b/lng/english.lng.php index dcb5ba16..3aec455c 100644 --- a/lng/english.lng.php +++ b/lng/english.lng.php @@ -1936,3 +1936,5 @@ $lng['admin']['domain_editable']['desc'] = 'If set to yes, the customer is allow // Added in Froxlor 0.9.29-dev1 $lng['serversettings']['panel_phpconfigs_hidestdsubdomain']['title'] = 'Hide standard-subdomains in PHP-configuration overview'; $lng['serversettings']['panel_phpconfigs_hidestdsubdomain']['description'] = 'If activated the standard-subdomains for customers will not be displayed in the php-configurations overview

Note: This is only visible if you have enabled FCGID or PHP-FPM'; +$lng['serversettings']['passwordcryptfunc']['title'] = 'Chose which password-crypt method is to be used'; +$lng['serversettings']['systemdefault'] = 'System default'; diff --git a/lng/german.lng.php b/lng/german.lng.php index 35483e07..c51c552a 100644 --- a/lng/german.lng.php +++ b/lng/german.lng.php @@ -1657,3 +1657,5 @@ $lng['admin']['domain_editable']['desc'] = 'Wenn ja, darf der Kunde verschiedene // Added in Froxlor 0.9.29-dev1 $lng['serversettings']['panel_phpconfigs_hidestdsubdomain']['title'] = 'Verstecke Standard-Subdomains in PHP-Konfigurations-Übersicht'; $lng['serversettings']['panel_phpconfigs_hidestdsubdomain']['description'] = 'Wenn aktiviert, werden die Standard-Subdomains der Kunden nicht mehr in der PHP-Konfigurations-Übersicht angezeigt.

Hinweis: Nur relevant, wenn FCGID oder PHP-FPM aktiviert ist.'; +$lng['serversettings']['passwordcryptfunc']['title'] = 'Wähle zu verwendende Passwort-Verschlüsselungsmethode'; +$lng['serversettings']['systemdefault'] = 'Systemstandard';