[phpldapadmin] [ phpldapadmin-Bugs-2997552 ] Unable to verify password using SMD5 scheme

Bugs item #2997552, was opened at 2010-05-06 13:09
Message generated for change (Tracker Item Submitted) made by loscara
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=498546&aid=2997552&group_id=61828

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: 1.2.x
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Matteo Scaramuccia (loscara)
Assigned to: Nobody/Anonymous (nobody)
Summary: Unable to verify password using SMD5 scheme

Initial Comment:
phpLDAPAdmin 1.2.0.5
OpenLDAP 2.3.43
Apache/2.2.3
PHP 5.2.13
CentOS release 5.4

We're moving to SMD5 but we're unable to check passwords from PLA.
It seems a bug since this patch below fixes the issue and the password checker (password_checker.php) returns consistent results as expected:

# diff -u functions.php.1.2.0.5 functions.php
--- functions.php.1.2.0.5       2010-05-06 12:49:23.000000000 +0200
+++ functions.php       2010-05-06 12:50:26.000000000 +0200
@@ -2240,7 +2240,7 @@
                        # Check php mhash support before using it
                        if (function_exists('mhash')) {
                                $hash = base64_decode($cryptedpassword);
-                               $salt = substr($hash,-4);
+                               $salt = substr($hash,16);
                                $new_hash = base64_encode(mhash(MHASH_MD5,$plainpassword.$salt).$salt);

                                if (strcmp($cryptedpassword,$new_hash) == 0)

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=498546&aid=2997552&group_id=61828

------------------------------------------------------------------------------
______________________________________
phpLDAPadmin development mailing list.
To unsbuscribe: https://lists.sourceforge.net/lists/listinfo/phpldapadmin-devel
http://phpldapadmin.sourceforge.net/