Mirrors/ICEcoder
2
0
Fork 0
mirror of https://github.com/icecoder/ICEcoder.git synced 2026-03-07 00:56:48 +01:00
Code Issues Packages Projects Releases Wiki Activity

Migrate to Bcrypt hashing for new passwords

Browse Source 
Fall back to legacy sha1 password hashing
This commit is contained in:
Matt Pass
2019-08-13 00:11:52 +01:00
committed by GitHub
parent 88b2108159
commit bc67286bb6
1 changed files with 17 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
lib/settings-common.php
View File

@@ -110,15 +110,24 @@ if (get_magic_quotes_gpc ()) {
$_REQUEST = (isset($_REQUEST) && !empty($_REQUEST)) ? array_map('stripslashes_deep', $_REQUEST) : array();
}
// Function to handle salted hashing
define('SALT_LENGTH',12);
function generateHash($plainText,$salt=null) {
if ($salt === null) {
$salt = substr(md5(uniqid(rand(), true)),0,SALT_LENGTH);
} else {
$salt = substr($salt,0,SALT_LENGTH);
}
return $salt.sha1($salt.$plainText);
// Generate hash
function generateHash($pw) {
// Generate Bcrypt hash
return str_replace("\$", "\\$", password_hash($pw, PASSWORD_BCRYPT, $options = ['cost' => 10]));
}
// Verify hash
function verifyHash($pw, $orig) {
// Verify Bcrypt hash
if (substr($orig, 0, 4) === "$2y$") {
return password_verify($pw, $orig)
? $orig
: "NO MATCH";
}
// Verify legacy sha1 hash
$origSalt = substr($orig,0,SALT_LENGTH);
return $origSalt.sha1($origSalt.$pw);
}
// returns converted entities which have HTML entity equivalents