* [FIX] Fixed issue with master pass hash after upgrading from 1.1. WARNING: the accounts encryption have not changed, only the master pass hash that is used to verify the correct password.

This commit is contained in:
nuxsmin
2015-10-10 14:00:37 +02:00
parent eea8c1885e
commit 6e2c461d72
17 changed files with 4273 additions and 3643 deletions

View File

@@ -38,15 +38,15 @@ class Crypt
* Generar un hash de una clave utilizando un salt.
*
* @param string $pwd con la clave a 'hashear'
* @param bool $appendSalt Añidor el salt al hash
* @param bool $prefixSalt Añadir el salt al hash
* @return string con el hash de la clave
*/
public static function mkHashPassword($pwd, $appendSalt = true)
public static function mkHashPassword($pwd, $prefixSalt = true)
{
$salt = self::makeHashSalt();
$hash = crypt($pwd, $salt);
return ($appendSalt === true) ? $salt . $hash : $hash;
return ($prefixSalt === true) ? $salt . $hash : $hash;
}
/**
@@ -100,25 +100,29 @@ class Crypt
* Comprobar el hash de una clave.
*
* @param string $pwd con la clave a comprobar
* @param string $originalHash con el hash a comprobar
* @param string $checkedHash con el hash a comprobar
* @param bool $isMPass si es la clave maestra
* @return bool
*/
public static function checkHashPass($pwd, $originalHash, $isMPass = false)
public static function checkHashPass($pwd, $checkedHash, $isMPass = false)
{
// Obtenemos el salt de la clave
$salt = substr($originalHash, 0, 72);
$salt = substr($checkedHash, 0, 72);
// Obtenemos el hash SHA256
$validHash = substr($originalHash, 72);
$validHash = substr($checkedHash, 72);
// Re-hash de la clave a comprobar
$testHash = crypt($pwd, $salt);
// Comprobar si el hash está en formato anterior a 12002
if ($isMPass && strlen($originalHash) === 128) {
ConfigDB::setValue('masterPwd', self::mkHashPassword($pwd));
Log::writeNewLog(_('Aviso'), _('Se ha regenerado el HASH de clave maestra. No es necesaria ninguna acción.'));
if ($isMPass && strlen($checkedHash) === 128) {
$check = (hash("sha256", substr($checkedHash, 0, 64) . $pwd) == substr($checkedHash, 64, 64));
return (hash("sha256", substr($originalHash, 0, 64) . $pwd) == substr($originalHash, 64, 64));
if ($check) {
ConfigDB::setValue('masterPwd', self::mkHashPassword($pwd));
Log::writeNewLog(_('Aviso'), _('Se ha regenerado el HASH de clave maestra. No es necesaria ninguna acción.'));
}
return $check;
}
// Si los hashes son idénticos, la clave es válida

View File

@@ -145,7 +145,7 @@ class Request
*/
public static function getRequestHeaders($header = '')
{
if (!function_exists('apache_request_headers')) {
if (!function_exists('\apache_request_headers')) {
function apache_request_headers()
{
foreach ($_SERVER as $key => $value) {

View File

@@ -42,16 +42,21 @@ class User extends UserBase
*/
public function updateUserMPass($masterPwd)
{
$configMPass = ConfigDB::getValue('masterPwd');
$configHashMPass = ConfigDB::getValue('masterPwd');
if (!$configMPass) {
if ($configHashMPass === false) {
return false;
}
if (Crypt::checkHashPass($masterPwd, $configMPass, true)) {
$strUserMPwd = Crypt::mkCustomMPassEncrypt(self::getCypherPass(), $masterPwd);
if (is_null($configHashMPass)){
$configHashMPass = Crypt::mkHashPassword($masterPwd);
ConfigDB::setValue('masterPwd', $configHashMPass);
}
if (!$strUserMPwd) {
if (Crypt::checkHashPass($masterPwd, $configHashMPass, true)) {
$cryptMPass = Crypt::mkCustomMPassEncrypt(self::getCypherPass(), $masterPwd);
if (!$cryptMPass) {
return false;
}
} else {
@@ -64,8 +69,8 @@ class User extends UserBase
. 'user_lastUpdateMPass = UNIX_TIMESTAMP() '
. 'WHERE user_id = :id LIMIT 1';
$data['mPass'] = $strUserMPwd[0];
$data['mIV'] = $strUserMPwd[1];
$data['mPass'] = $cryptMPass[0];
$data['mIV'] = $cryptMPass[1];
$data['id'] = $this->_userId;
return DB::getQuery($query, __FUNCTION__, $data);
@@ -106,7 +111,7 @@ class User extends UserBase
return false;
}
return ($showPass == true) ? $clearMasterPass : SessionUtil::saveSessionMPass($clearMasterPass);
return ($showPass === true) ? $clearMasterPass : SessionUtil::saveSessionMPass($clearMasterPass);
}
return false;

View File

@@ -55,7 +55,7 @@ class UserPass
$configHashMPass = ConfigDB::getValue('masterPwd');
if ($configHashMPass === false) {
if ($configHashMPass === false || is_null($configHashMPass)) {
return false;
}

File diff suppressed because it is too large Load Diff

View File

@@ -8,8 +8,8 @@ msgid ""
msgstr ""
"Project-Id-Version: sysPass\n"
"Report-Msgid-Bugs-To: \n"
"POT-Creation-Date: 2015-10-09 00:26+0100\n"
"PO-Revision-Date: 2015-10-09 00:28+0100\n"
"POT-Creation-Date: 2015-10-09 01:00+0100\n"
"PO-Revision-Date: 2015-10-09 01:00+0100\n"
"Last-Translator: nuxsmin <nuxsmin@syspass.org>\n"
"Language-Team: nuxsmin@syspass.org\n"
"Language: en_US\n"
@@ -4994,18 +4994,3 @@ msgstr "Make a backup and export"
#: ../../../../inc/themes/material-blue/security.inc:4
msgid "Autentificación"
msgstr "Authentication"
#~ msgid "Gestión de Clientes y Categorías"
#~ msgstr "Customer and Categories management"
#~ msgid "Reset"
#~ msgstr "Restablecer"
#~ msgid "Error en clave RSA"
#~ msgstr "Error on RSA key"
#~ msgid "Nueva Clave (Verificar)"
#~ msgstr "New Password (Verify)"
#~ msgid "Clave (Verificar)"
#~ msgstr "Password (Verify)"

File diff suppressed because it is too large Load Diff

File diff suppressed because it is too large Load Diff

File diff suppressed because it is too large Load Diff

File diff suppressed because it is too large Load Diff

View File

@@ -1,41 +1,106 @@
-- To 1.1
ALTER TABLE `accFiles` CHANGE COLUMN `accfile_name` `accfile_name` VARCHAR(100) NOT NULL
ALTER TABLE `accounts` ADD COLUMN `account_otherGroupEdit` BIT(1) NULL DEFAULT 0 AFTER `account_dateEdit`, ADD COLUMN `account_otherUserEdit` BIT(1) NULL DEFAULT 0 AFTER `account_otherGroupEdit`;
CREATE TABLE `accUsers` (`accuser_id` INT NOT NULL AUTO_INCREMENT,`accuser_accountId` INT(10) UNSIGNED NOT NULL,`accuser_userId` INT(10) UNSIGNED NOT NULL, PRIMARY KEY (`accuser_id`), INDEX `idx_account` (`accuser_accountId` ASC));
ALTER TABLE `accHistory` ADD COLUMN `accHistory_otherUserEdit` BIT NULL AFTER `acchistory_mPassHash`, ADD COLUMN `accHistory_otherGroupEdit` VARCHAR(45) NULL AFTER `accHistory_otherUserEdit`;
ALTER TABLE `accFiles` CHANGE COLUMN `accfile_type` `accfile_type` VARCHAR(100) NOT NULL ;
ALTER TABLE `accounts` ADD COLUMN `account_otherGroupEdit` BIT(1) NULL DEFAULT 0
AFTER `account_dateEdit`, ADD COLUMN `account_otherUserEdit` BIT(1) NULL DEFAULT 0
AFTER `account_otherGroupEdit`;
CREATE TABLE `accUsers` (
`accuser_id` INT NOT NULL AUTO_INCREMENT,
`accuser_accountId` INT(10) UNSIGNED NOT NULL,
`accuser_userId` INT(10) UNSIGNED NOT NULL,
PRIMARY KEY (`accuser_id`),
INDEX `idx_account` (`accuser_accountId` ASC)
);
ALTER TABLE `accHistory` ADD COLUMN `accHistory_otherUserEdit` BIT NULL
AFTER `acchistory_mPassHash`, ADD COLUMN `accHistory_otherGroupEdit` VARCHAR(45) NULL
AFTER `accHistory_otherUserEdit`;
ALTER TABLE `accFiles` CHANGE COLUMN `accfile_type` `accfile_type` VARCHAR(100) NOT NULL;
-- To 1.1.2.1
ALTER TABLE `categories` ADD COLUMN `category_description` VARCHAR(255) NULL AFTER `category_name`;
ALTER TABLE `usrProfiles` ADD COLUMN `userProfile_pAppMgmtMenu` BIT(1) NULL DEFAULT b'0' AFTER `userProfile_pUsersMenu`,CHANGE COLUMN `userProfile_pConfigCategories` `userProfile_pAppMgmtCategories` BIT(1) NULL DEFAULT b'0' AFTER `userProfile_pAppMgmtMenu`,ADD COLUMN `userProfile_pAppMgmtCustomers` BIT(1) NULL DEFAULT b'0' AFTER `userProfile_pAppMgmtCategories`;
ALTER TABLE `categories` ADD COLUMN `category_description` VARCHAR(255) NULL
AFTER `category_name`;
ALTER TABLE `usrProfiles` ADD COLUMN `userProfile_pAppMgmtMenu` BIT(1) NULL DEFAULT b'0'
AFTER `userProfile_pUsersMenu`, CHANGE COLUMN `userProfile_pConfigCategories` `userProfile_pAppMgmtCategories` BIT(1) NULL DEFAULT b'0'
AFTER `userProfile_pAppMgmtMenu`, ADD COLUMN `userProfile_pAppMgmtCustomers` BIT(1) NULL DEFAULT b'0'
AFTER `userProfile_pAppMgmtCategories`;
-- To 1.1.2.2
ALTER TABLE `usrData` CHANGE COLUMN `user_login` `user_login` VARCHAR(50) NOT NULL ,CHANGE COLUMN `user_email` `user_email` VARCHAR(80) NULL DEFAULT NULL ;
ALTER TABLE `usrData` CHANGE COLUMN `user_login` `user_login` VARCHAR(50) NOT NULL, CHANGE COLUMN `user_email` `user_email` VARCHAR(80) NULL DEFAULT NULL;
-- To 1.1.2.3
CREATE TABLE `usrPassRecover` (`userpassr_id` INT UNSIGNED NOT NULL AUTO_INCREMENT, `userpassr_userId` SMALLINT UNSIGNED NOT NULL,`userpassr_hash` VARBINARY(40) NOT NULL,`userpassr_date` INT UNSIGNED NOT NULL,`userpassr_used` BIT(1) NOT NULL DEFAULT b\'0\', PRIMARY KEY (`userpassr_id`),INDEX `IDX_userId` (`userpassr_userId` ASC, `userpassr_date` ASC)) DEFAULT CHARACTER SET = utf8 COLLATE = utf8_general_ci;
ALTER TABLE `log` ADD COLUMN `log_ipAddress` VARCHAR(45) NOT NULL AFTER `log_userId`;
ALTER TABLE `usrData` ADD COLUMN `user_isChangePass` BIT(1) NULL DEFAULT b'0' AFTER `user_isMigrate`;
CREATE TABLE `usrPassRecover` (
`userpassr_id` INT UNSIGNED NOT NULL AUTO_INCREMENT,
`userpassr_userId` SMALLINT UNSIGNED NOT NULL,
`userpassr_hash` VARBINARY(40) NOT NULL,
`userpassr_date` INT UNSIGNED NOT NULL,
`userpassr_used` BIT(1) NOT NULL DEFAULT b'0',
PRIMARY KEY (`userpassr_id`),
INDEX `IDX_userId` (`userpassr_userId` ASC, `userpassr_date` ASC)
)
DEFAULT CHARACTER SET = utf8
COLLATE = utf8_general_ci;
ALTER TABLE `log` ADD COLUMN `log_ipAddress` VARCHAR(45) NOT NULL
AFTER `log_userId`;
ALTER TABLE `usrData` ADD COLUMN `user_isChangePass` BIT(1) NULL DEFAULT b'0'
AFTER `user_isMigrate`;
-- To 1.1.2.12
ALTER TABLE `usrData` CHANGE COLUMN `user_mPass` `user_mPass` VARBINARY(32) NULL DEFAULT NULL ,CHANGE COLUMN `user_lastLogin` `user_lastLogin` DATETIME NULL DEFAULT NULL ,CHANGE COLUMN `user_lastUpdate` `user_lastUpdate` DATETIME NULL DEFAULT NULL, CHANGE COLUMN `user_mIV` `user_mIV` VARBINARY(32) NULL ;
ALTER TABLE `accounts` CHANGE COLUMN `account_login` `account_login` VARCHAR(50) NULL DEFAULT NULL ;
ALTER TABLE `usrData` CHANGE COLUMN `user_mPass` `user_mPass` VARBINARY(32) NULL DEFAULT NULL, CHANGE COLUMN `user_lastLogin` `user_lastLogin` DATETIME NULL DEFAULT NULL, CHANGE COLUMN `user_lastUpdate` `user_lastUpdate` DATETIME NULL DEFAULT NULL, CHANGE COLUMN `user_mIV` `user_mIV` VARBINARY(32) NULL;
ALTER TABLE `accounts` CHANGE COLUMN `account_login` `account_login` VARCHAR(50) NULL DEFAULT NULL;
-- To 1.1.2.13
ALTER TABLE `usrData` CHANGE COLUMN `user_mPass` `user_mPass` VARBINARY(32) NULL DEFAULT NULL ,CHANGE COLUMN `user_lastLogin` `user_lastLogin` DATETIME NULL DEFAULT NULL ,CHANGE COLUMN `user_lastUpdate` `user_lastUpdate` DATETIME NULL DEFAULT NULL, CHANGE COLUMN `user_mIV` `user_mIV` VARBINARY(32) NULL ;';
ALTER TABLE `usrData` CHANGE COLUMN `user_mPass` `user_mPass` VARBINARY(32) NULL DEFAULT NULL, CHANGE COLUMN `user_lastLogin` `user_lastLogin` DATETIME NULL DEFAULT NULL, CHANGE COLUMN `user_lastUpdate` `user_lastUpdate` DATETIME NULL DEFAULT NULL, CHANGE COLUMN `user_mIV` `user_mIV` VARBINARY(32) NULL;
ALTER TABLE `accounts` CHANGE COLUMN `account_login` `account_login` VARCHAR(50) NULL DEFAULT NULL;
-- To 1.1.2.19
ALTER TABLE `accounts` CHANGE COLUMN `account_pass` `account_pass` VARBINARY(255) NOT NULL ;
ALTER TABLE `accHistory` CHANGE COLUMN `acchistory_pass` `acchistory_pass` VARBINARY(255) NOT NULL ;
ALTER TABLE `accounts` CHANGE COLUMN `account_pass` `account_pass` VARBINARY(255) NOT NULL;
ALTER TABLE `accHistory` CHANGE COLUMN `acchistory_pass` `acchistory_pass` VARBINARY(255) NOT NULL;
-- To 1.1.2.20
ALTER TABLE `usrData` CHANGE COLUMN `user_pass` `user_pass` VARBINARY(255) NOT NULL,CHANGE COLUMN `user_mPass` `acchistory_pass` VARBINARY(255) DEFAULT NULL ;
ALTER TABLE `usrData` CHANGE COLUMN `user_pass` `user_pass` VARBINARY(255) NOT NULL, CHANGE COLUMN `user_mPass` `acchistory_pass` VARBINARY(255) DEFAULT NULL;
-- To 1.2.0.1
ALTER TABLE `accounts` CHANGE COLUMN `account_userEditId` `account_userEditId` TINYINT(3) UNSIGNED NULL DEFAULT NULL, CHANGE COLUMN `account_dateEdit` `account_dateEdit` DATETIME NULL DEFAULT NULL;
ALTER TABLE `accHistory` CHANGE COLUMN `acchistory_userEditId` `acchistory_userEditId` TINYINT(3) UNSIGNED NULL DEFAULT NULL, CHANGE COLUMN `acchistory_dateEdit` `acchistory_dateEdit` DATETIME NULL DEFAULT NULL;
ALTER TABLE `accHistory` CHANGE COLUMN `accHistory_otherGroupEdit` `accHistory_otherGroupEdit` BIT NULL DEFAULT b\'0\';
ALTER TABLE `accHistory` CHANGE COLUMN `accHistory_otherGroupEdit` `accHistory_otherGroupEdit` BIT NULL DEFAULT b'0';
ALTER TABLE `usrProfiles` ADD COLUMN `userProfile_profile` BLOB NOT NULL;
ALTER TABLE `usrData` ADD `user_preferences` BLOB NULL;
CREATE TABLE usrToGroups (usertogroup_id INT UNSIGNED PRIMARY KEY NOT NULL AUTO_INCREMENT,usertogroup_userId INT UNSIGNED NOT NULL,usertogroup_groupId INT UNSIGNED NOT NULL) DEFAULT CHARSET=utf8;
CREATE INDEX IDX_accountId ON usrToGroups (usertogroup_userId)
CREATE TABLE usrToGroups (
usertogroup_id INT UNSIGNED PRIMARY KEY NOT NULL AUTO_INCREMENT,
usertogroup_userId INT UNSIGNED NOT NULL,
usertogroup_groupId INT UNSIGNED NOT NULL
)
DEFAULT CHARSET = utf8;
CREATE INDEX IDX_accountId ON usrToGroups (usertogroup_userId);
ALTER TABLE `accFiles` ADD `accFile_thumb` BLOB NULL;
CREATE TABLE `authTokens` (`authtoken_id` int(11) NOT NULL AUTO_INCREMENT,`authtoken_userId` int(11) NOT NULL,`authtoken_token` varbinary(100) NOT NULL,`authtoken_actionId` smallint(5) unsigned NOT NULL,`authtoken_createdBy` smallint(5) unsigned NOT NULL,`authtoken_startDate` int(10) unsigned NOT NULL,PRIMARY KEY (`authtoken_id`),UNIQUE KEY `unique_authtoken_id` (`authtoken_id`),KEY `IDX_checkToken` (`authtoken_userId`,`authtoken_actionId`,`authtoken_token`)) ENGINE=InnoDB DEFAULT CHARSET=utf8;
CREATE TABLE `customFieldsDef` (`customfielddef_id` int(10) unsigned NOT NULL AUTO_INCREMENT, `customfielddef_module` smallint(5) unsigned NOT NULL, `customfielddef_field` blob NOT NULL, PRIMARY KEY (`customfielddef_id`)) ENGINE=InnoDB DEFAULT CHARSET=utf8;
CREATE TABLE `customFieldsData` (`customfielddata_id` int(10) unsigned NOT NULL AUTO_INCREMENT,`customfielddata_moduleId` smallint(5) unsigned NOT NULL,`customfielddata_itemId` int(10) unsigned NOT NULL,`customfielddata_defId` int(10) unsigned NOT NULL,`customfielddata_data` longblob,`customfielddata_iv` varbinary(128) DEFAULT NULL, PRIMARY KEY (`customfielddata_id`), KEY `IDX_DEFID` (`customfielddata_defId`), KEY `IDX_DELETE` (`customfielddata_itemId`,`customfielddata_moduleId`), KEY `IDX_UPDATE` (`customfielddata_moduleId`,`customfielddata_itemId`,`customfielddata_defId`), KEY `IDX_ITEM` (`customfielddata_itemId`), KEY `IDX_MODULE` (`customfielddata_moduleId`)) ENGINE=InnoDB DEFAULT CHARSET=utf8;
CREATE TABLE `authTokens` (
`authtoken_id` INT(11) NOT NULL AUTO_INCREMENT,
`authtoken_userId` INT(11) NOT NULL,
`authtoken_token` VARBINARY(100) NOT NULL,
`authtoken_actionId` SMALLINT(5) UNSIGNED NOT NULL,
`authtoken_createdBy` SMALLINT(5) UNSIGNED NOT NULL,
`authtoken_startDate` INT(10) UNSIGNED NOT NULL,
PRIMARY KEY (`authtoken_id`),
UNIQUE KEY `unique_authtoken_id` (`authtoken_id`),
KEY `IDX_checkToken` (`authtoken_userId`, `authtoken_actionId`, `authtoken_token`)
)
ENGINE = InnoDB
DEFAULT CHARSET = utf8;
CREATE TABLE `customFieldsDef` (
`customfielddef_id` INT(10) UNSIGNED NOT NULL AUTO_INCREMENT,
`customfielddef_module` SMALLINT(5) UNSIGNED NOT NULL,
`customfielddef_field` BLOB NOT NULL,
PRIMARY KEY (`customfielddef_id`)
)
ENGINE = InnoDB
DEFAULT CHARSET = utf8;
CREATE TABLE `customFieldsData` (
`customfielddata_id` INT(10) UNSIGNED NOT NULL AUTO_INCREMENT,
`customfielddata_moduleId` SMALLINT(5) UNSIGNED NOT NULL,
`customfielddata_itemId` INT(10) UNSIGNED NOT NULL,
`customfielddata_defId` INT(10) UNSIGNED NOT NULL,
`customfielddata_data` LONGBLOB,
`customfielddata_iv` VARBINARY(128) DEFAULT NULL,
PRIMARY KEY (`customfielddata_id`),
KEY `IDX_DEFID` (`customfielddata_defId`),
KEY `IDX_DELETE` (`customfielddata_itemId`, `customfielddata_moduleId`),
KEY `IDX_UPDATE` (`customfielddata_moduleId`, `customfielddata_itemId`, `customfielddata_defId`),
KEY `IDX_ITEM` (`customfielddata_itemId`),
KEY `IDX_MODULE` (`customfielddata_moduleId`)
)
ENGINE = InnoDB
DEFAULT CHARSET = utf8;
-- To 1.2.0.2
ALTER TABLE config CHANGE config_value config_value VARCHAR(255);
ALTER TABLE usrData CHANGE user_pass user_pass VARBINARY(255);