Changeset 1441

Timestamp:

04/16/06 19:02:08 (2 years ago)

Author:

sdcosta

Message:

Changes to the login system so that the password is not sent in cleartext and firefox remembers it. Mobile login will be fixed in the next changeset.
Please reset your password using the password reset plugin http://plugins.gregarius.net/index.php?req=info&id=29

Location:

trunk/rss

Files:

• admin/index.php (modified) (1 diff)
• admin/users.php (modified) (3 diffs)
• ajax.php (modified) (1 diff)
• cls/wrappers/header.php (modified) (1 diff)

trunk/rss/admin/index.php

@@ -81 +81 @@
         $admin_uname = null;
         $admin_pass = null;
-        if (isset($_POST['admin_uname']) && isset($_POST['admin_pass'])) {
-            $admin_uname = $_POST['admin_uname'];
-            $admin_pass = $_POST['admin_pass'];
+        if (isset($_POST['username']) && isset($_POST['password'])) {
+            $admin_uname = $_POST['username'];
+            $admin_pass = $_POST['password'];
         }
         set_admin_pass($admin_uname,$admin_pass);

trunk/rss/admin/users.php

@@ -48 +48 @@
     <!--
         function on_submit_password_match() {
-            pass=document.getElementById('admin_pass').value;
-            pass2=document.getElementById('admin_pass2').value;
+            pass=document.getElementById('password').value;
+            pass2=document.getElementById('password2').value;
             if(pass !== pass2){
                 msg = '<?php echo LBL_ADMIN_PASS_NO_MATCH ?>';
                 document.getElementById('admin_match_result').innerHTML = msg;
-                document.getElementById('admin_pass').value = '';
-                document.getElementById('admin_pass2').value = '';
+                document.getElementById('password').value = '';
+                document.getElementById('password2').value = '';
                 return false;
             }else{
-                return true;
+                document.getElementById('password2').value = '';
+                return loginHandler();
             }
         }   
@@ -70 +71 @@
     echo "<form action=\"".$_SERVER['PHP_SELF'] . "\" onsubmit=\"return on_submit_password_match();\" method=\"post\">\n"
     ."<fieldset style=\"width:400px;\">"
-    ."<p><label style=\"display:block\" for=\"admin_uname\">".LBL_USERNAME.":</label>\n"
-    ."<input type=\"text\" id=\"admin_uname\" name=\"admin_uname\" /></p>\n"
-    ."<p><label style=\"display:block\" for=\"admin_pass\">".LBL_PASSWORD.":</label>\n"
-    ."<input type=\"password\" id=\"admin_pass\" name=\"admin_pass\" /></p>\n"
-    ."<p><label style=\"display:block\" for=\"admin_pass2\">".LBL_PASSWORD2.":</label>\n"
-    ."<input type=\"password\" id=\"admin_pass2\" name=\"admin_pass2\" /></p>\n"
+    ."<p><label style=\"display:block\" for=\"username\">".LBL_USERNAME.":</label>\n"
+    ."<input type=\"text\" id=\"username\" name=\"username\" /></p>\n"
+    ."<p><label style=\"display:block\" for=\"password\">".LBL_PASSWORD.":</label>\n"
+    ."<input type=\"password\" id=\"password\" name=\"password\" /></p>\n"
+    ."<p><label style=\"display:block\" for=\"password2\">".LBL_PASSWORD2.":</label>\n"
+    ."<input type=\"password\" id=\"password2\" name=\"password2\" /></p>\n"
     ."<p><input type=\"submit\" value=\"".LBL_ADMIN_OK."\" /></p>\n"
     ."<div style=\"display:inline;\" id=\"admin_match_result\"></div>\n"
@@ -91 +92 @@
   echo "\n<div id=\"channel_admin\" class=\"frame\">";
         
-    echo "<form id=\"admin_login\" style=\"text-align:center\" action=\"".$_SERVER['PHP_SELF'] ."\" method=\"post\">\n"
+    echo "<form id=\"admin_login\" onsubmit=\"return loginHandler();\" 
+        style=\"text-align:center\" action=\"".$_SERVER['PHP_SELF'] ."\" method=\"post\">\n"
     ."<fieldset>"
     ."<legend>" . LBL_ADMIN_LOGIN . "</legend>\n"

trunk/rss/ajax.php

@@ -171 +171 @@
 function loginHandler() {
     pw = document.getElementById('password');
-    var re = new RegExp('/[0-9a-f]{32}/');
+    username = document.getElementById('username');
+    var re = /[0-9a-f]{32}/ ;
     if (! re.test(pw.value)) {
-        alert('hashing');
-        pw.value = hex_md5(pw.value);
-    } else {
-        alert('not hashing');
-    }
+        pw.value = hex_md5(pw.value + username.value);
+    } 
     return true;
 }

trunk/rss/cls/wrappers/header.php

@@ -146 +146 @@
                 ."&nbsp;|&nbsp;<a href=\"#\" onclick=\"miniloginform(); return false;\">".LBL_LOG_IN."</a>";
         $ret .= "<span style=\"display:none\" id=\"loginformcontainer\">"
-                         . '<form ' /*onsubmit="return loginHandler();" */ .'method="post" action="'.getPath().'">'
+                         . '<form ' . 'onsubmit="return loginHandler();" ' . 'method="post" action="'.getPath().'">'
                          . '<input style=" width:50px;" name="username" id="username" type="text" />'
                          . '<input style=" width:50px;" name="password" id="password"  type="password" />'