Changeset 33 for trunk/actions_dntp/login.action.php

Timestamp:

09/03/05 22:42:52 (7 years ago)

Author:

alexx

Message:

• Auth: Remove MySQL PASSWORD hashing method to hash password, replace by MD5 hashing, add code to make a smooth transition between hashing method
• XML engine: Fix a trivial recent bug in dotnode-xml.php
• Robots: fix a bug in crontab script robots/launch_robots.sh (add cd dirname $0)
• CSS: Add max_width to image in blog (work on Mozilla/*, Opera but not good on Safari (no proportional resizing), of course, that doesn't work on IE)
• DB: changing DB structure !!!

  ALTER TABLE `user` ADD `passwd_md5` CHAR( 32 ) NOT NULL AFTER `passwd` ;
  ALTER TABLE `user` CHANGE `passwd` `passwd` VARCHAR( 42 ) NULL ;
  ALTER TABLE `dntp_translator` ADD `passwd_md5` CHAR( 32 ) NOT NULL AFTER `passwd` ;
  ALTER TABLE `dntp_translator` CHANGE `passwd` `passwd` VARCHAR( 42 ) NULL ;
  

Files:

• trunk/actions_dntp/login.action.php (modified) (1 diff)

trunk/actions_dntp/login.action.php

@@ -26 +26 @@
 if( $_POST['login'] && $_POST['passwd'])
 {
-        $values = array( $_POST['login'], $_POST['passwd'] );
 
-                $user =& $db->getRow('SELECT id_translator, login, status, lang, level FROM dntp_translator WHERE login=? AND passwd=PASSWORD(?)', $values);
-        if( $user )
+        $user =& $db->getRow('SELECT id_translator, login, status, lang, level FROM dntp_translator WHERE login=? AND (passwd_md5=? OR passwd=OLD_PASSWORD(?))', array( $_POST['login'], md5($_POST['passwd'], $_POST['passwd'])));
+        
+        if( $user['id'] )
         {
+                if(!is_null($user['passwd']))
+                        $db->query('UPDATE dntp_translator SET passwd_md5=?, passwd=NULL WHERE id=?', array(md5($_POST['passwd']), $user['id']));
+                                        
                 @session_destroy();