Move to old hashing algorithm (backward compatibility), fixes

philleconnect · May 25, 2020 · 2d4ceaa · 2d4ceaa
1 parent cf87bea
commit 2d4ceaa
Show file tree

Hide file tree

Showing 4 changed files with 14 additions and 3 deletions.
diff --git a/clientapi/php/client.php b/clientapi/php/client.php
@@ -227,7 +227,7 @@
                 array('paththree', "Laufwerk Z"),
                 array('infotext', $result['comment']),
                 array('room', $config['room']),
-                array('machinename', $config['machine']),
+                array('machinename', $config['name']),
                 array('groupfolders', $groupfolders));
             if ($config['requiresLogin'] == '0') {
                 array_push($data, array('servicemode', 'noPasswordRequired'));

diff --git a/clientapi/php/functions.php b/clientapi/php/functions.php
@@ -28,7 +28,7 @@ function checkUserPassword($username, $password) {
         }
         $response = $stmt->get_result();
         $result = $response->fetch_assoc();
-        if (password_verify($password, $result["unix_hash"])) {
+        if (check_unix($password, $result["unix_hash"])) {
             return true;
         }
         return false;

diff --git a/clientapi/php/hash.php b/clientapi/php/hash.php
@@ -1,8 +1,18 @@
 <?php
     function unix($input) {
-        return password_hash($input, PASSWORD_BCRYPT);
+        $salt = substr(str_shuffle(str_repeat('ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789', 4)), 0, 4);
+        return '{SSHA}' . base64_encode(sha1($input.$salt, TRUE).$salt);
     }
     function samba($input) {
         return strtoupper(bin2hex(mhash(MHASH_MD4, iconv("UTF-8", "UTF-16LE", $input))));
     }
+    function check_unix($password, $hash) {
+        if ($hash == "") {
+            return false;
+        }
+        $salt = substr(base64_decode(substr($hash,6)),20);
+        $encrypted_password = '{SSHA}' . base64_encode(sha1( $password.$salt, TRUE ). $salt);
+        if ($hash == $encrypted_password) return true;
+        return false;
+    }
 ?>
diff --git a/clientapi/php/register.php b/clientapi/php/register.php
@@ -2,6 +2,7 @@
 /*  Backend for PhilleConnect client registration
     © 2017 - 2020 Johannes Kreutz.*/
     require "dbconnect.php";
+    require "hash.php";
     require "functions.php";
     if (!isUserUnique($_POST["uname"])) {
         echo "error";