From 52cf654c20ce983bfdbc169c7a9e241b60869873 Mon Sep 17 00:00:00 2001
From: steveminutillo <steveminutillo@a5d648f4-9e1a-0410-98de-79dcf2039bee>
Date: Wed, 6 Jun 2007 03:34:15 +0000
Subject: [PATCH] save a hash of the password instead of the password itself in
 the DB (requires schema upgrade, just run install.php again)

---
 fof-db.php  |  4 ++--
 install.php | 21 ++++++++++++++++++---
 login.php   |  2 +-
 prefs.php   |  5 +++--
 4 files changed, 24 insertions(+), 8 deletions(-)

diff --git a/fof-db.php b/fof-db.php
index 7ddd82f..4e81bbf 100644
--- a/fof-db.php
+++ b/fof-db.php
@@ -58,7 +58,7 @@ function fof_db_query($sql, $live=0)
       //echo "<pre>";
       //print_r(debug_backtrace());
       //echo "</pre>";
-      die("Cannot query database.  Have you run <a href=\"install.php\"><code>install.php</code></a>? MySQL says: <b>". mysql_error() . "</b>");
+      die("Cannot query database.  Have you run <a href=\"install.php\"><code>install.php</code></a> to create or upgrade your installation? MySQL says: <b>". mysql_error() . "</b>");
       }
       return $result;
    }
@@ -306,7 +306,7 @@ function fof_db_authenticate($user_name, $user_password_hash)
 {
    global $FOF_USER_TABLE, $FOF_ITEM_TABLE, $FOF_ITEM_TAG_TABLE, $fof_connection, $fof_user_id, $fof_user_name, $fof_user_level, $fof_user_prefs;
    
-   $sql = "select * from $FOF_USER_TABLE where user_name = '$user_name' and md5(user_password) = '" . mysql_escape_string($user_password_hash) . "'";
+   $sql = "select * from $FOF_USER_TABLE where user_name = '$user_name' and user_password_hash = '" . mysql_escape_string($user_password_hash) . "'";
    
    $result = fof_db_query($sql);
    
diff --git a/install.php b/install.php
index 7760649..aa69026 100644
--- a/install.php
+++ b/install.php
@@ -34,9 +34,9 @@ header("Content-Type: text/html; charset=utf-8");
 <?php
 if($_GET['password'])
 {
-	$password = mysql_real_escape_string($_GET['password']);
+	$password_hash = mysql_real_escape_string(md5($_GET['password'] . 'admin'));
 	
-	fof_db_query("insert into $FOF_USER_TABLE (user_id, user_name, user_password, user_level) values (1, 'admin', '$password', 'admin')");
+	fof_db_query("insert into $FOF_USER_TABLE (user_id, user_name, user_password_hash, user_level) values (1, 'admin', '$password_hash', 'admin')");
 	
 	echo 'OK!  Setup complete! <a href=".">Login as admin</a>, and start subscribing!';
 }
@@ -108,7 +108,7 @@ $tables[] = <<<EOQ
 CREATE TABLE IF NOT EXISTS `$FOF_USER_TABLE` (
   `user_id` int(11) NOT NULL auto_increment,
   `user_name` varchar(100) NOT NULL default '',
-  `user_password` varchar(32) NOT NULL default '',
+  `user_password_hash` varchar(32) NOT NULL default '',
   `user_level` enum('user','admin') NOT NULL default 'user',
   `user_prefs` text,
   PRIMARY KEY  (`user_id`)
@@ -126,6 +126,21 @@ foreach($tables as $table)
 ?>
 Tables exist.<br><br>
 
+<?php
+$result = fof_db_query("show columns from $FOF_USER_TABLE like 'user_password_hash'");
+
+if(mysql_num_rows($result) == 0)
+{
+
+print "Upgrading schema...";
+
+fof_db_query("ALTER TABLE $FOF_USER_TABLE CHANGE `user_password` `user_password_hash` VARCHAR( 32 ) NOT NULL");
+fof_db_query("update $FOF_USER_TABLE set user_password_hash = md5(concat(user_password_hash, user_name))");
+
+print "Done.<BR><BR>";
+}
+?>
+
 Inserting initial data...
 
 <?php
diff --git a/login.php b/login.php
index b2dc770..bc66ffd 100644
--- a/login.php
+++ b/login.php
@@ -21,7 +21,7 @@ header("Content-Type: text/html; charset=utf-8");
 
 if(isset($_POST["user_name"]) && isset($_POST["user_password"]))
 {
-    if(fof_authenticate($_POST['user_name'], md5($_POST['user_password'])))
+    if(fof_authenticate($_POST['user_name'], md5($_POST['user_password'] . $_POST['user_name'])))
     {
         Header("Location: .");
     }
diff --git a/prefs.php b/prefs.php
index c56cd93..35e7c75 100644
--- a/prefs.php
+++ b/prefs.php
@@ -28,8 +28,9 @@ if(isset($_POST['adduser']) && isset($_POST['username']) && isset($_POST['passwo
 {
 	$username = $_POST['username'];
 	$password = $_POST['password'];
-	
-	fof_db_query("insert into $FOF_USER_TABLE (user_name, user_password) values ('$username', '$password')");
+	$password_hash = md5($password . $username);
+
+	fof_db_query("insert into $FOF_USER_TABLE (user_name, user_password_hash) values ('$username', '$password_hash')");
 	
 	$message = "User '$username' added.";
 }