Skip to content
This repository has been archived by the owner on Jun 19, 2022. It is now read-only.

Commit

Permalink
Bezpečnější uložení hesel
Browse files Browse the repository at this point in the history
  • Loading branch information
@petrkle
petrkle committed Sep 15, 2016
1 parent 2eebff0 commit 0ca2107
Show file tree
Hide file tree
Showing 6 changed files with 61 additions and 67 deletions.
10 changes: 4 additions & 6 deletions func.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -277,14 +277,12 @@ function get_user_props($login){
$navrat['jmeno']=trim(array_pop($jmeno));
}

if(is_file(LIDE_DATA.'/'.$login.'/passwd.sha1')){
$heslo = file(LIDE_DATA.'/'.$login.'/passwd.sha1');
$navrat['passwd_sha1']=trim(array_pop($heslo));
if(is_file(LIDE_DATA.'/'.$login.'/passwd.crypt')){
$navrat['passwd_crypt']=trim(file_get_contents(LIDE_DATA.'/'.$login.'/passwd.crypt'));
}

if(is_file(LIDE_DATA.'/'.$login.'/soukromi.txt')){
$soukromi = file(LIDE_DATA.'/'.$login.'/soukromi.txt');
$navrat['soukromi']=trim(array_pop($soukromi));
$navrat['soukromi']=trim(file_get_contents(LIDE_DATA.'/'.$login.'/soukromi.txt'));
}

if(is_file(LIDE_DATA.'/'.$login.'/vzkaz.txt')){
Expand Down Expand Up @@ -583,7 +581,7 @@ function create_heslo(){
$heslo='';
$znaky=array('a','c','e','f','h','k','m','n','r','s','t','u','v','w','2','3','4','7','8','9');
shuffle($znaky);
for($foo=0;$foo<8;$foo++){
for($foo=0;$foo<10;$foo++){
$heslo.=array_pop($znaky);
}
return $heslo;
Expand Down
4 changes: 2 additions & 2 deletions lide/add.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -28,8 +28,8 @@
mkdir($tmp);
}

$foo=fopen($tmp.'/passwd.sha1','w');
fwrite($foo,sha1($heslo.$login));
$foo=fopen($tmp.'/passwd.crypt','w');
fwrite($foo, password_hash($heslo, PASSWORD_DEFAULT));
fclose($foo);

$foo=fopen($tmp.'/jmeno.txt','w');
Expand Down
1 change: 0 additions & 1 deletion lide/aktivace.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -17,4 +17,3 @@
$smarty->display('hlavicka.tpl');
$smarty->display('aktivace.tpl');
$smarty->display('paticka.tpl');

8 changes: 4 additions & 4 deletions lide/nastaveni.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -464,7 +464,7 @@
$odpoved='';
}

if(sha1($heslo.$_SESSION['uzivatel']['login'])!=$_SESSION['uzivatel']['passwd_sha1']){
if(!password_verify($heslo, $_SESSION['uzivatel']['passwd_crypt'])){
array_push($chyby,'Špatné heslo.');
}

Expand Down Expand Up @@ -616,13 +616,13 @@
array_push($chyby,'Nově zadaná hesla se neshodují.');
}

if(sha1($stareheslo.$_SESSION['uzivatel']['login'])!=$_SESSION['uzivatel']['passwd_sha1']){
if(!password_verify($stareheslo, $_SESSION['uzivatel']['passwd_crypt'])){
array_push($chyby,'Špatně zadané aktuální heslo.');
}

if(count($chyby)==0){
$foo=fopen(LIDE_DATA.'/'.$_SESSION['uzivatel']['login'].'/passwd.sha1','w');
fwrite($foo,sha1($heslo.$_SESSION['uzivatel']['login']));
$foo=fopen(LIDE_DATA.'/'.$_SESSION['uzivatel']['login'].'/passwd.crypt','w');
fwrite($foo, password_hash($heslo, PASSWORD_DEFAULT));
fclose($foo);
$_SESSION['uzivatel']=get_user_complete($_SESSION['uzivatel']['login']);
header('Location: '.LIDE_URL.'nastaveni/?result=ok_heslo');
Expand Down
4 changes: 2 additions & 2 deletions lide/obnova-hesla.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -91,8 +91,8 @@
array_push($chyby,'Zadaná hesla se neshodují.');
}
if(count($chyby)==0){
$foo=fopen(LIDE_DATA.'/'.$uzivatel['login'].'/passwd.sha1','w');
fwrite($foo,sha1($heslo.$uzivatel['login']));
$foo=fopen(LIDE_DATA.'/'.$uzivatel['login'].'/passwd.crypt','w');
fwrite($foo, password_hash($heslo, PASSWORD_DEFAULT));
fclose($foo);
unlink($rtf);
unlink($rtk);
Expand Down
101 changes: 49 additions & 52 deletions lide/prihlaseni.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -78,9 +78,9 @@

$login=trim(file_get_contents(LIDE_TMP.'/'.$input_login.'/login.txt'));

$passwd_hash=trim(file_get_contents(LIDE_TMP.'/'.$input_login.'/passwd.sha1'));
$passwd_hash=trim(file_get_contents(LIDE_TMP.'/'.$input_login.'/passwd.crypt'));

if(sha1($input_heslo.$login)!=$passwd_hash){
if(!password_verify($input_heslo, $passwd_hash)){
spatne_jmeno_nebo_heslo();
}

Expand All @@ -96,7 +96,7 @@
fclose($foo);

rename($tmp.'/jmeno.txt',$user.'/jmeno.txt');
rename($tmp.'/passwd.sha1',$user.'/passwd.sha1');
rename($tmp.'/passwd.crypt',$user.'/passwd.crypt');
rename($tmp.'/soukromi.txt',$user.'/soukromi.txt');

unlink($tmp.'/login.txt');
Expand Down Expand Up @@ -134,18 +134,6 @@

}


if(is_zs_account($input_login)){
# starý zpusob přihlášení
array_push($chyby,'Zůsob přihlašování do žonglérova slabikáře se změnil.','Pro přihlášení použij <strong>email</strong> zadaný při registraci.','Omlouvám se za způsobené potíže.');
$smarty->assign('chyby',$chyby);
$smarty->assign('trail', $trail->path);
$smarty->display('hlavicka.tpl');
$smarty->display('prihlaseni.tpl');
$smarty->display('paticka.tpl');
exit();
}

if(is_zs_email($input_login)){
# ověření hesla, pokus o přihlášení
$login=email2login($input_login);
Expand All @@ -169,27 +157,59 @@
exit();
}

$passwd_hash = file(LIDE_DATA.'/'.$uzivatel['login'].'/passwd.sha1');
$passwd_hash = trim(array_pop($passwd_hash));
if(sha1($input_heslo.$login)==$passwd_hash){
# úspěšné přihlášení
if (!isset($_SESSION)) {
session_name('ZS');
session_start();
if(is_file(LIDE_DATA.'/'.$uzivatel['login'].'/passwd.sha1')){
$passwd_hash_old = trim(file_get_contents(LIDE_DATA.'/'.$uzivatel['login'].'/passwd.sha1'));

if(sha1($input_heslo.$login)==$passwd_hash_old){
# úspěšné přihlášení
if (!isset($_SESSION)) {
session_name('ZS');
session_start();
}

$foo=fopen(LIDE_DATA.'/'.$uzivatel['login'].'/passwd.crypt','w');
fwrite($foo, password_hash($input_heslo, PASSWORD_DEFAULT));
fclose($foo);
unlink(LIDE_DATA.'/'.$uzivatel['login'].'/passwd.sha1');

load_user($uzivatel['login']);
header('Location: '.$next);
exit();
}else{
spatne_jmeno_nebo_heslo();
}
load_user($uzivatel['login']);
header('Location: '.$next);
exit();
}else{
spatne_jmeno_nebo_heslo();
}
}

if(is_file(LIDE_DATA.'/'.$uzivatel['login'].'/passwd.crypt')){
$passwd_hash = trim(file_get_contents(LIDE_DATA.'/'.$uzivatel['login'].'/passwd.crypt'));

if(password_verify($input_heslo, $passwd_hash)){
# úspěšné přihlášení
if (!isset($_SESSION)) {
session_name('ZS');
session_start();
}

if(password_needs_rehash($passwd_hash, PASSWORD_DEFAULT)){
$foo=fopen(LIDE_DATA.'/'.$uzivatel['login'].'/passwd.crypt','w');
fwrite($foo, password_hash($input_heslo, PASSWORD_DEFAULT));
fclose($foo);
}

load_user($uzivatel['login']);
header('Location: '.$next);
exit();
}else{
spatne_jmeno_nebo_heslo();
}
}

}else{
spatne_jmeno_nebo_heslo();
}

}else{


$smarty->assign('trail', $trail->path);
$smarty->display('hlavicka.tpl');
$smarty->display('prihlaseni.tpl');
Expand All @@ -215,26 +235,3 @@ function is_new_account($input_login){
}
return $navrat;
}

function get_simple_changelog($cas){
if(is_readable($_SERVER['DOCUMENT_ROOT'].'/ChangeLog')){

$zmeny=array();
$rn=1;
$changelog = array_reverse(file($_SERVER['DOCUMENT_ROOT'].'/ChangeLog'));
foreach ($changelog as $change){
$change=preg_split('/\*/',trim($change));
if($change[1]>$cas){
$zmeny[$rn]['cislo']=$rn;
$zmeny[$rn]['hash']=$change[0];
$zmeny[$rn]['datum_hr'] = date('j. n. Y G.i',$change[1]);
$zmeny[$rn]['cas']=$change[1];
$zmeny[$rn]['popis']=$change[2];
$zmeny[$rn]['typ']='change';
}
$rn++;
}
}
return array_reverse($zmeny);
}

0 comments on commit 0ca2107

Please sign in to comment.