Changeset 33 for trunk/actions/my/password/record.action.php

Timestamp:

09/03/05 22:42:52 (7 years ago)

Author:

alexx

Message:

• Auth: Remove MySQL PASSWORD hashing method to hash password, replace by MD5 hashing, add code to make a smooth transition between hashing method
• XML engine: Fix a trivial recent bug in dotnode-xml.php
• Robots: fix a bug in crontab script robots/launch_robots.sh (add cd dirname $0)
• CSS: Add max_width to image in blog (work on Mozilla/*, Opera but not good on Safari (no proportional resizing), of course, that doesn't work on IE)
• DB: changing DB structure !!!

  ALTER TABLE `user` ADD `passwd_md5` CHAR( 32 ) NOT NULL AFTER `passwd` ;
  ALTER TABLE `user` CHANGE `passwd` `passwd` VARCHAR( 42 ) NULL ;
  ALTER TABLE `dntp_translator` ADD `passwd_md5` CHAR( 32 ) NOT NULL AFTER `passwd` ;
  ALTER TABLE `dntp_translator` CHANGE `passwd` `passwd` VARCHAR( 42 ) NULL ;
  

Files:

• trunk/actions/my/password/record.action.php (modified) (1 diff)

trunk/actions/my/password/record.action.php

@@ -23 +23 @@
  ******************** http://opensource.ikse.net/projects/dotnode ***/
 
-$nb = $db->getOne('SELECT COUNT(id) FROM user WHERE id=? AND passwd=PASSWORD(?)', array($_SESSION['my_id'], $_POST['oldpasswd']));
-//print_r($nb);
+$nb = $db->getOne('SELECT COUNT(id) FROM user WHERE id=? AND passwd_md5=?', array($_SESSION['my_id'], md5($_POST['oldpasswd'])));
+
 if($nb == 1 || isset($_SESSION['old_password']))
 {
         if($_POST['passwd1'] == $_POST['passwd2'] && strlen($_POST['passwd1']) >3)
         {
-                $db->query('UPDATE user SET passwd=PASSWORD(?) WHERE id=?', array($_POST['passwd1'], $_SESSION['my_id']) );
+                $db->query('UPDATE user SET passwd_md5=? WHERE id=?', array(md5($_POST['passwd1']), $_SESSION['my_id']) );
                 header('Location: /my');
         }