- global $db, $user, $cache, $phpbb_root_path, $phpbb_dispatcher;

- $forum_data_sql['forum_password'] = phpbb_hash($forum_data_sql['forum_password']);

- $update_password = ($data['new_password'] && !phpbb_check_hash($data['new_password'], $user_row['user_password'])) ? true : false;

- 'user_password' => phpbb_hash($data['new_password']),

- 'forum_password' => array('VCHAR_UNI:40', ''),

- 'user_password' => array('VCHAR_UNI:40', ''),

-* @version Version 0.1 / slightly modified for phpBB 3.1.x (using $H$ as hash type identifier)

-*

-* Portable PHP password hashing framework.

-*

-* Written by Solar Designer <solar at openwall.com> in 2004-2006 and placed in

-* the public domain.

-*

-* There's absolutely no warranty.

-*

-* The homepage URL for this framework is:

-*

-* http://www.openwall.com/phpass/

-*

-* Please be sure to update the Version line if you edit this file in any way.

-* It is suggested that you leave the main version number intact, but indicate

-* your project name (after the slash) and add your own revision information.

-*

-* Please do not change the "private" password hashing method implemented in

-* here, thereby making your hashes incompatible. However, if you must, please

-* change the hash type identifier (the "$P$") to something different.

-*

-* Obviously, since this code is in the public domain, the above are not

-* requirements (there can be none), but merely suggestions.

-* Hash the password

- $itoa64 = './0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz';

-

- $random_state = unique_id();

- $random = '';

- $count = 6;

-

- if (($fh = @fopen('/dev/urandom', 'rb')))

- {

- $random = fread($fh, $count);

- fclose($fh);

- }

-

- if (strlen($random) < $count)

- {

- $random = '';

-

- for ($i = 0; $i < $count; $i += 16)

- {

- $random_state = md5(unique_id() . $random_state);

- $random .= pack('H*', md5($random_state));

- }

- $random = substr($random, 0, $count);

- }

-

- $hash = _hash_crypt_private($password, _hash_gensalt_private($random, $itoa64), $itoa64);

-

- if (strlen($hash) == 34)

- {

- return $hash;

- }

- return md5($password);

- if (strlen($password) > 4096)

- {

- // If the password is too huge, we will simply reject it

- // and not let the server try to hash it.

- return false;

- }

-

- $itoa64 = './0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz';

- if (strlen($hash) == 34)

- {

- return (_hash_crypt_private($password, $hash, $itoa64) === $hash) ? true : false;

- }

- return (md5($password) === $hash) ? true : false;

-}

-

-/**

-* Generate salt for hash generation

-*/

-function _hash_gensalt_private($input, &$itoa64, $iteration_count_log2 = 6)

-{

- if ($iteration_count_log2 < 4 || $iteration_count_log2 > 31)

- {

- $iteration_count_log2 = 8;

- }

-

- $output = '$H$';

- $output .= $itoa64[min($iteration_count_log2 + 5, 30)];

- $output .= _hash_encode64($input, 6, $itoa64);

-

- return $output;

-}

-

-/**

-* Encode hash

-*/

-function _hash_encode64($input, $count, &$itoa64)

-{

- $output = '';

- $i = 0;

-

- do

- {

- $value = ord($input[$i++]);

- $output .= $itoa64[$value & 0x3f];

-

- if ($i < $count)

- {

- $value |= ord($input[$i]) << 8;

- }

-

- $output .= $itoa64[($value >> 6) & 0x3f];

-

- if ($i++ >= $count)

- {

- break;

- }

-

- if ($i < $count)

- {

- $value |= ord($input[$i]) << 16;

- }

-

- $output .= $itoa64[($value >> 12) & 0x3f];

-

- if ($i++ >= $count)

- {

- break;

- }

-

- $output .= $itoa64[($value >> 18) & 0x3f];

- }

- while ($i < $count);

-

- return $output;

-}

-

-/**

-* The crypt function/replacement

-*/

-function _hash_crypt_private($password, $setting, &$itoa64)

-{

- $output = '*';

-

- // Check for correct hash

- if (substr($setting, 0, 3) != '$H$' && substr($setting, 0, 3) != '$P$')

- {

- return $output;

- }

-

- $count_log2 = strpos($itoa64, $setting[3]);

-

- if ($count_log2 < 7 || $count_log2 > 30)

- {

- return $output;

- }

-

- $count = 1 << $count_log2;

- $salt = substr($setting, 4, 8);

-

- if (strlen($salt) != 8)

- {

- return $output;

- }

-

- /**

- * We're kind of forced to use MD5 here since it's the only

- * cryptographic primitive available in all versions of PHP

- * currently in use. To implement our own low-level crypto

- * in PHP would result in much worse performance and

- * consequently in lower iteration counts and hashes that are

- * quicker to crack (by non-PHP code).

- */

- $hash = md5($salt . $password, true);

- do

- {

- $hash = md5($hash . $password, true);

- }

- while (--$count);

-

- $output = substr($setting, 0, 12);

- $output .= _hash_encode64($hash, 16, $itoa64);

-

- return $output;

- global $db, $config, $user, $template, $phpEx;

- $password = request_var('password', '', true);

- if (phpbb_check_hash($password, $forum_data['forum_password']))

- global $request;

- if (!preg_match('#(?:acl_([a-z0-9_]+)(,\$id)?)|(?:\$id)|(?:aclf_([a-z0-9_]+))|(?:cfg_([a-z0-9_]+))|(?:request_([a-zA-Z0-9_]+))#', $token))

- eval('$is_auth = (int) (' . preg_replace(array('#acl_([a-z0-9_]+)(,\$id)?#', '#\$id#', '#aclf_([a-z0-9_]+)#', '#cfg_([a-z0-9_]+)#', '#request_([a-zA-Z0-9_]+)#'), array('(int) $auth->acl_get(\'\\1\'\\2)', '(int) $forum_id', '(int) $auth->acl_getf_global(\'\\1\')', '(int) $config[\'\\1\']', '$request->variable(\'\\1\', false)'), $module_auth) . ');');

- function methods()

- function data()

- function data()

- $json_response->send($this->attachment_data);

- $sql = 'SELECT attach_id, is_orphan, real_filename, attach_comment

- $sql = 'SELECT attach_id, is_orphan, real_filename, attach_comment

- if (!sizeof($error) && $auth->acl_get('u_chgpasswd') && $data['new_password'] && phpbb_check_hash($data['new_password'], $user->data['user_password']))

- if (!phpbb_check_hash($data['cur_password'], $user->data['user_password']))

- 'user_password' => ($auth->acl_get('u_chgpasswd') && $data['new_password']) ? phpbb_hash($data['new_password']) : $user->data['user_password'],

- if ($auth->acl_get('u_chgpasswd') && $data['new_password'] && !phpbb_check_hash($data['new_password'], $user->data['user_password']))

- 'user_password' => phpbb_hash($data['new_password']),

- global $db, $user, $auth, $template;

- SET user_newpasswd = '" . $db->sql_escape(phpbb_hash($user_password)) . "', user_actkey = '" . $db->sql_escape($user_actkey) . "'