public/tt-rss
1
0
Fork 0
mirror of https://git.tt-rss.org/git/tt-rss.git synced 2025-12-31 00:51:28 +00:00
Code Issues Releases Wiki Activity

simplify internal authentication code and bump default algo to SSHA-512

Browse Source
This commit is contained in:
Andrew Dolgov
2021-03-01 15:24:18 +03:00
parent 320503dd39
commit 6359259dbb
10 changed files with 152 additions and 169 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
classes/pref/users.php
View File

@@ -107,7 +107,7 @@ class Pref_Users extends Handler_Administrative {
function editSave() {
$login = clean($_REQUEST["login"]);
$uid = clean($_REQUEST["id"]);
$uid = (int) clean($_REQUEST["id"]);
$access_level = (int) clean($_REQUEST["access_level"]);
$email = clean($_REQUEST["email"]);
$password = clean($_REQUEST["password"]);
@@ -118,19 +118,13 @@ class Pref_Users extends Handler_Administrative {
// forbid renaming admin
if ($uid == 1) $login = "admin";
if ($password) {
$salt = substr(bin2hex(get_random_bytes(125)), 0, 250);
$pwd_hash = encrypt_password($password, $salt, true);
$pass_query_part = "pwd_hash = ".$this->pdo->quote($pwd_hash).",
salt = ".$this->pdo->quote($salt).",";
} else {
$pass_query_part = "";
}
$sth = $this->pdo->prepare("UPDATE ttrss_users SET $pass_query_part login = LOWER(?),
access_level = ?, email = ?, otp_enabled = false WHERE id = ?");
$sth = $this->pdo->prepare("UPDATE ttrss_users SET login = LOWER(?),
access_level = ?, email = ?, otp_enabled = false WHERE id = ?");
$sth->execute([$login, $access_level, $email, $uid]);
if ($password) {
UserHelper::reset_password($uid, false, $password);
}
}
function remove() {
@@ -153,8 +147,8 @@ class Pref_Users extends Handler_Administrative {
function add() {
$login = clean($_REQUEST["login"]);
$tmp_user_pwd = make_password();
$salt = substr(bin2hex(get_random_bytes(125)), 0, 250);
$pwd_hash = encrypt_password($tmp_user_pwd, $salt, true);
$salt = UserHelper::get_salt();
$pwd_hash = UserHelper::hash_password($tmp_user_pwd, $salt, UserHelper::HASH_ALGOS[0]);
if (!$login) return; // no blank usernames