From a1890fb94dea87ce3075c32c299ac7197ec89c6c Mon Sep 17 00:00:00 2001 From: Andy Blyler Date: Mon, 24 Feb 2003 00:13:41 +0000 Subject: [PATCH] using php md5 instead of mysql password() git-svn-id: svn+ssh://repo.cacti.net/var/data/svnroot/cacti/trunk/cacti@581 860744bd-22fc-0310-8c96-e9fe5004b5ca --- auth_login.php | 3 ++- user_admin.php | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/auth_login.php b/auth_login.php index 210c0d89a..910fe84d9 100644 --- a/auth_login.php +++ b/auth_login.php @@ -29,7 +29,8 @@ if (!isset($_REQUEST["action"])) { $_REQUEST["action"] = ""; } switch ($_REQUEST["action"]) { case 'login': - $user = db_fetch_row("select * from user where username='" . $_POST["username"] . "' and password = PASSWORD('" . $_POST["password"] . "')"); + db_execute("update user set password = '" . md5($_POST["password"]) . "' where username='" . $_POST["username"] . "' and password = PASSWORD('" . $_POST["password"] . "')"); + $user = db_fetch_row("select * from user where username='" . $_POST["username"] . "' and password = '" . md5($_POST["password"]) . "'"); if (sizeof($user)) { /* --- GOOD username/password --- */ diff --git a/user_admin.php b/user_admin.php index 4f7cbc163..ce16e0d29 100644 --- a/user_admin.php +++ b/user_admin.php @@ -103,7 +103,7 @@ function form_save() { if (($_POST["password"] == "") && ($_POST["password_confirm"] == "")) { $password = db_fetch_cell("select password from user where id=" . $_POST["id"]); }else{ - $password = "PASSWORD('" . $_POST["password"] . "')"; + $password = "'" . md5($_POST["password"]) . "'"; } /* check to make sure the passwords match; if not error */