Changeset 5367 in subversion

Timestamp:

Oct 26, 2011 7:53:23 AM (20 months ago)

Author:

alec

Message:

• Improve generated crypt() passwords (#1488136)

Location:

trunk/plugins/password

Files:

• drivers/sql.php (modified) (2 diffs)
• package.xml (modified) (2 diffs)

trunk/plugins/password/drivers/sql.php

@@ -38 +38 @@
     if (strpos($sql, '%c') !== FALSE) {
         $salt = '';
-        if (CRYPT_MD5) { 
-            $len = rand(3, CRYPT_SALT_LENGTH);
+        if (CRYPT_MD5) {
+            // Always use eight salt characters for MD5 (#1488136)
+            $len = 8;
         } else if (CRYPT_STD_DES) {
             $len = 2;
@@ -45 +46 @@
             return PASSWORD_CRYPT_ERROR;
         }
+
+        //Restrict the character set used as salt (#1488136)
+        $seedchars = './0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz';
         for ($i = 0; $i < $len ; $i++) {
-            $salt .= chr(rand(ord('.'), ord('z')));
+            $salt .= $seedchars[rand(0, 63)];
         }
+
         $sql = str_replace('%c',  $db->quote(crypt($passwd, CRYPT_MD5 ? '$1$'.$salt.'$' : $salt)), $sql);
     }

trunk/plugins/password/package.xml

@@ -16 +16 @@
                 <active>yes</active>
         </lead>
-        <date></date>
-        <time></time>
+        <date>2011-10-26</date>
+        <time>12:00</time>
         <version>
-                <release></release>
+                <release>2.3</release>
                 <api>1.6</api>
         </version>
@@ -32 +32 @@
 - Added 'password_change' hook for plugin actions after successful password change
 - Fixed bug where 'doveadm pw' command was used as dovecotpw utility
+- Improve generated crypt() passwords (#1488136)
     </notes>
         <contents>