jaredesguerra4757 said:
Ysmods , I think you need to change this
Code:
$newPassword = $password;
with
Code:
$newPassword = Password::createHash($password);
Else when the user tries to login , the password hash does not match since the password was initially saved as plain text.
Please correct me if i am wrong.
You are completely wrong
When the user is added to the database, its using:
Code:
$newUser = UserPeer::create($username, $newPassword, $emailAddress, $title, $firstname, $lastname);
Which is in userpeer.class.php
Code:
static function create($username, $password, $email, $title, $firstname, $lastname, $accType = 'user')
{
$dbInsert = new DBObject("users", array("username", "password", "email",
"title", "firstname", "lastname", "datecreated",
"createdip", "status", "level_id", "paymentTracker", "identifier")
);
$dbInsert->username = $username;
$dbInsert->password = MD5($password);
$dbInsert->email = $email;
$dbInsert->title = $title;
$dbInsert->firstname = $firstname;
$dbInsert->lastname = $lastname;
$dbInsert->datecreated = coreFunctions::sqlDateTime();
$dbInsert->createdip = coreFunctions::getUsersIPAddress();
$dbInsert->status = 'active';
$dbInsert->level_id = 1;
$dbInsert->paymentTracker = MD5(time() . $username);
$dbInsert->identifier = MD5(time() . $username . $password);
if ($dbInsert->insert())
{
return $dbInsert;
}
return false;
}
As you can see, the password is not stored in plain text because of this line
Code:
$dbInsert->password = MD5($password);
Then when a user logs in for the first time the password is converted to the new hashing method
Code:
public function login($username, $rawPassword, $fromLoginForm = false)
{
$rs = $this->convertPassword($username, $rawPassword);
if ($rs == false)
{
return false;
}
return $this->attemptLogin($username, $rawPassword, false, $fromLoginForm);
}
This happens
Code:
$rs = $this->convertPassword($username, $rawPassword);
Which matches the md5'd password in the database with the plaintext password
Code:
if ($user['password'] == md5($rawPassword))
Then converts the password to sha256 instead of md5
Code:
$sha256Password = Password::createHash($rawPassword);
If I would have used
Code:
$newPassword = Password::createHash($password);
When the user was added to the database by UserPeer::create, the password is hashed using md5, so the hashed password from Password::createHash would never work
For example, the password was
password
The password hashed using Password::createHash would be something like
Code:
sha256:1000:6fbPTSlmuvBZVm200aMhzVAnzNbPvY56:u7i03MfaWISj/Y0RA4BoKWHctyBNuvlo
The password hashed using md5 would be
Code:
5f4dcc3b5aa765d61d8327deb882cf99
So when the user is created using UserPeer::create Your already hashed password from Password::createHash would be hashed again using md5 into
Code:
9c66259fdd4c121d9a2770958eb42aab
and added to the database.
Then the user tries to log in
Code:
public function login($username, $rawPassword, $fromLoginForm = false)
{
$rs = $this->convertPassword($username, $rawPassword);
if ($rs == false)
{
return false;
}
return $this->attemptLogin($username, $rawPassword, false, $fromLoginForm);
}
The Password will always return false from $this->attemptLogin due to the password hashes not matching.
Only reason that $newPassword = $password; is because it was nearly 2am when I made that mod and to save editing a couple of things, I set $newPassword = $password;
