diff --git a/interface/lib/classes/auth.inc.php b/interface/lib/classes/auth.inc.php index 1002bd6949f8d5515ff161f8b75d36ddc93cf6bf..aa4eb9f30cfe154680d9ced6243c2506e63cdca4 100644 --- a/interface/lib/classes/auth.inc.php +++ b/interface/lib/classes/auth.inc.php @@ -132,6 +132,16 @@ class auth { } return $password; } + + public function crypt_password($cleartext_password) { + $salt="$1$"; + $base64_alphabet='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'; + for ($n=0;$n<8;$n++) { + $salt.=$base64_alphabet[mt_rand(0,63)]; + } + $salt.="$"; + return crypt($cleartext_password,$salt); + } } diff --git a/interface/lib/classes/tform.inc.php b/interface/lib/classes/tform.inc.php index dbaf686e113cc733e202a157ba38bd3d7e818635..673a7d7f527d4077e6cf5e16ec9d43153b583ba2 100644 --- a/interface/lib/classes/tform.inc.php +++ b/interface/lib/classes/tform.inc.php @@ -903,15 +903,7 @@ class tform { if($field['formtype'] == 'PASSWORD') { $sql_insert_key .= "`$key`, "; if($field['encryption'] == 'CRYPT') { - $salt="$1$"; - $base64_alphabet='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'; - for ($n=0;$n<8;$n++) { - //$salt.=chr(mt_rand(64,126)); - $salt.=$base64_alphabet[mt_rand(0,63)]; - } - $salt.="$"; - // $salt = substr(md5(time()),0,2); - $record[$key] = crypt(stripslashes($record[$key]),$salt); + $record[$key] = $app->auth->crypt_password(stripslashes($record[$key])); $sql_insert_val .= "'".$app->db->quote($record[$key])."', "; } elseif ($field['encryption'] == 'MYSQL') { $sql_insert_val .= "PASSWORD('".$app->db->quote($record[$key])."'), "; @@ -938,15 +930,7 @@ class tform { } else { if($field['formtype'] == 'PASSWORD') { if(isset($field['encryption']) && $field['encryption'] == 'CRYPT') { - $salt="$1$"; - $base64_alphabet='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'; - for ($n=0;$n<8;$n++) { - //$salt.=chr(mt_rand(64,126)); - $salt.=$base64_alphabet[mt_rand(0,63)]; - } - $salt.="$"; - // $salt = substr(md5(time()),0,2); - $record[$key] = crypt(stripslashes($record[$key]),$salt); + $record[$key] = $app->auth->crypt_password(stripslashes($record[$key])); $sql_update .= "`$key` = '".$app->db->quote($record[$key])."', "; } elseif (isset($field['encryption']) && $field['encryption'] == 'MYSQL') { $sql_update .= "`$key` = PASSWORD('".$app->db->quote($record[$key])."'), "; diff --git a/interface/web/client/client_edit.php b/interface/web/client/client_edit.php index 4581397534e2e63ee86e8517391e8666129cae4e..58963611415ab679b9531096da4420d9a282b74a 100644 --- a/interface/web/client/client_edit.php +++ b/interface/web/client/client_edit.php @@ -149,14 +149,7 @@ class page_action extends tform_actions { $type = 'user'; $active = 1; $language = $app->db->quote($this->dataRecord["language"]); - - $salt="$1$"; - $base64_alphabet='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'; - for ($n=0;$n<8;$n++) { - $salt.=$base64_alphabet[mt_rand(0,63)]; - } - $salt.="$"; - $password = crypt(stripslashes($password),$salt); + $password = $app->auth->crypt_password($password); // Create the controlpaneluser for the client //Generate ssh-rsa-keys diff --git a/interface/web/login/password_reset.php b/interface/web/login/password_reset.php index 5c23cc495b47b19237ab193e024557351dbeb92b..659859adf560267a585b79c596c380e19adc0e51 100644 --- a/interface/web/login/password_reset.php +++ b/interface/web/login/password_reset.php @@ -52,15 +52,8 @@ if(isset($_POST['username']) && $_POST['username'] != '' && $_POST['email'] != ' $client = $app->db->queryOneRecord("SELECT * FROM client WHERE username = '$username' AND email = '$email'"); if($client['client_id'] > 0) { - $new_password = md5 (uniqid (rand())); - $salt="$1$"; - $base64_alphabet='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'; - for ($n=0;$n<8;$n++) { - //$salt.=chr(mt_rand(64,126)); - $salt.=$base64_alphabet[mt_rand(0,63)]; - } - $salt.="$"; - $new_password_encrypted = crypt($new_password,$salt); + $new_password = $app->auth->get_random_password(); + $new_password_encrypted = $app->auth->crypt_password($new_password); $new_password_encrypted = $app->db->quote($new_password_encrypted); $username = $app->db->quote($client['username']);