diff options
| author | Nils Adermann <naderman@naderman.de> | 2007-02-25 22:09:53 +0000 |
|---|---|---|
| committer | Nils Adermann <naderman@naderman.de> | 2007-02-25 22:09:53 +0000 |
| commit | b66e0fcd34d3209ca86059d1737125699a726a7d (patch) | |
| tree | 96f2a08d958122e7f0c4780c718694646ac4e846 /phpBB/includes/auth/auth_db.php | |
| parent | 424a520d0e3d8f668b70c632a8d787f004d8098b (diff) | |
| download | forums-b66e0fcd34d3209ca86059d1737125699a726a7d.tar forums-b66e0fcd34d3209ca86059d1737125699a726a7d.tar.gz forums-b66e0fcd34d3209ca86059d1737125699a726a7d.tar.bz2 forums-b66e0fcd34d3209ca86059d1737125699a726a7d.tar.xz forums-b66e0fcd34d3209ca86059d1737125699a726a7d.zip | |
- fix htmlspecialchars handling in search (search backends get specialchared input, and should return specialchared output), current backends strip entities anyway [includes Bug #8156]
- allow cancelling search index creation/removal
- custom CSS class name input too short [Bug #8328]
- give an error message if a password wasn't convertable (special characters in non-standard encoding)
- moved still_on_time to functions.php, used by acp_search and converter, might be useful for MODs (or complex cron scripts)
- do not allow empty passwords on login
- add sids to local URLs in posts (this was a really terrible bug to fix ;-)) [Bug #7892]
- ignore invalid HTTP_X_FORWARDED_FOR headers (just use REMOTE_ADDR if invalid) [Bug #8314]
- changed forum listing code on search page and acp_attachments [Bug #6658]
- search indexing uses still_on_time(), smaller batch size (1000) and meta_refresh() instead of redirect(), this should solve a few problems [Bugs #8034, #8270]
- made password requirement language strings clearer
- ALPHA is not meant to be alphanumric [Bug #7764]
- display bug in firefox on linux making the pagination wrap on search results page (caused by )
git-svn-id: file:///svn/phpbb/trunk@7076 89ea8834-ac86-4346-8a33-228a782c2dd0
Diffstat (limited to 'phpBB/includes/auth/auth_db.php')
| -rw-r--r-- | phpBB/includes/auth/auth_db.php | 47 |
1 files changed, 36 insertions, 11 deletions
diff --git a/phpBB/includes/auth/auth_db.php b/phpBB/includes/auth/auth_db.php index baf193ecdb..afea47d1c1 100644 --- a/phpBB/includes/auth/auth_db.php +++ b/phpBB/includes/auth/auth_db.php @@ -103,19 +103,44 @@ function login_db(&$username, &$password) $password_old_format = (!STRIP) ? addslashes($password_old_format) : $password_old_format; $password_new_format = ''; - set_var($password_new_format, $password_old_format, 'string'); + set_var($password_new_format, stripslashes($password_old_format), 'string'); - if ($password == $password_new_format && md5($password_old_format) == $row['user_password']) + if ($password == $password_new_format) { - // Update the password in the users table to the new format and remove user_pass_convert flag - $sql = 'UPDATE ' . USERS_TABLE . ' - SET user_password = \'' . $db->sql_escape(md5($password_new_format)) . '\', - user_pass_convert = 0 - WHERE user_id = ' . $row['user_id']; - $db->sql_query($sql); - - $row['user_pass_convert'] = 0; - $row['user_password'] = md5($password_new_format); + if (!function_exists('utf8_to_cp1252')) + { + global $phpbb_root_path, $phpEx; + include($phpbb_root_path . 'includes/utf/data/recode_basic.' . $phpEx); + } + + // cp1252 is phpBB2's default encoding, characters outside ASCII range might work when converted into that encoding + if (md5($password_old_format) == $row['user_password'] || utf8_to_cp1252(md5($password_old_format)) == $row['user_password']) + { + // Update the password in the users table to the new format and remove user_pass_convert flag + $sql = 'UPDATE ' . USERS_TABLE . ' + SET user_password = \'' . $db->sql_escape(md5($password_new_format)) . '\', + user_pass_convert = 0 + WHERE user_id = ' . $row['user_id']; + $db->sql_query($sql); + + $row['user_pass_convert'] = 0; + $row['user_password'] = md5($password_new_format); + } + else if (preg_match('/[\x80-\xFF]/', $password_old_format)) + { + // Although we weren't able to convert this password we have to + // increase login attempt count to make sure this cannot be exploited + $sql = 'UPDATE ' . USERS_TABLE . ' + SET user_login_attempts = user_login_attempts + 1 + WHERE user_id = ' . $row['user_id']; + $db->sql_query($sql); + + return array( + 'status' => LOGIN_ERROR_PASSWORD_CONVERT, + 'error_msg' => 'LOGIN_ERROR_PASSWORD_CONVERT', + 'user_row' => $row, + ); + } } } |