瀏覽代碼

Merge branch 'better-password-encryption' of clement/BIM into master

Clément Krebs 2 年之前
父節點
當前提交
f240156065
共有 1 個文件被更改,包括 6 次插入1 次删除
  1. 6 1
      src/models/user.php

+ 6 - 1
src/models/user.php

@@ -79,7 +79,12 @@ function change_password($current_password, $new_passwd) {
     if (!$ldap_bind) {
     if (!$ldap_bind) {
         return array(false, "Wrong current password");
         return array(false, "Wrong current password");
     }
     }
-    if (!ldap_exop_passwd($ldapconn, $dn, "",$new_passwd)) {
+
+    $salt = random_bytes(4);
+    $hash = "{SSHA512}" . base64_encode(pack("H*", hash('sha512', $new_passwd . $salt)) .$salt);
+    $entry["userPassword"] = $hash;
+
+    if (! ldap_mod_replace($ldapconn, $dn, $entry)) {
         return array(false, "A problem occured, contact admins");
         return array(false, "A problem occured, contact admins");
     }
     }