changes in plugin change_password
Pablo Alvarez de Sotomayor Posadillo <[email protected]>
| Newsgroups | gmane.mail.squirrelmail.devel |
|---|---|
| Message-ID | <[email protected]> |
Hi all,
In one of the mail system I'm administrate I use the digest-md5 method to
store the passwords in a mysql table, so I've decided to add this encrypt
method to the change_password plugin. I'm using squirrelmail 1.5.2 from
subversion. I send you attached the patch to include it in the case.
I've seen that the plugin didn't make any variable checking, and this is a
potential bug, specially with those variables sets by the user. Should I add
some variable checking to the plugin? Also, if you are interested I can add
new methods to store the password in the plugin.
I have another doubt, but this is about the functionality: Can I actually have
configured a different password for squirrelmail webmail and the imap server?
I know it can sound a bit strange this question, but I'm interested in give
access to some users only to squirrelmail but not to imap server.
Regards
--
Pablo Alvarez de Sotomayor Posadillo
Ingeniero Tecnico en Informatica de Sistemas
http://ritho.net
"De todas las cosas que he perdido la que
mas hecho de menos es mi cerebro"
-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
-----
squirrelmail-devel mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: [email protected]
List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel
plugin_change_password_digest_md5.patch
(text/x-diff, 2.4 KB)
Index: plugins/change_password/backend/mysql.php
===================================================================
--- plugins/change_password/backend/mysql.php (revision 13271)
+++ plugins/change_password/backend/mysql.php (working copy)
@@ -17,7 +17,7 @@
global $mysql_server, $mysql_database, $mysql_table, $mysql_userid_field,
$mysql_password_field, $mysql_manager_id, $mysql_manager_pw,
- $mysql_saslcrypt, $mysql_unixcrypt, $cpw_mysql;
+ $mysql_saslcrypt, $mysql_unixcrypt, $mysql_digest_md5_crypt, $cpw_mysql;
// Initialize defaults
$mysql_server = 'localhost';
@@ -35,6 +35,7 @@
// saslcrypt checked first - if it is 1, UNIX crypt is not used.
$mysql_saslcrypt = 0; // use MySQL password() function
$mysql_unixcrypt = 0; // use UNIX crypt() function
+$mysql_digest_md5_crypt = 0; // use md5() function with digest method
// get overrides from config.
if ( isset($cpw_mysql) && is_array($cpw_mysql) && !empty($cpw_mysql) )
@@ -75,7 +76,7 @@
global $mysql_server, $mysql_database, $mysql_table, $mysql_userid_field,
$mysql_password_field, $mysql_manager_id, $mysql_manager_pw,
- $mysql_saslcrypt, $mysql_unixcrypt;
+ $mysql_saslcrypt, $mysql_unixcrypt, $mysql_digest_md5_crypt;
// TODO: allow to choose between mysql_connect() and mysql_pconnect() functions.
$ds = mysql_pconnect($mysql_server, $mysql_manager_id, $mysql_manager_pw);
@@ -98,6 +99,8 @@
} elseif ($mysql_unixcrypt) {
// FIXME: why password field name is used for salting
$query_string .= '=encrypt("'.mysql_real_escape_string($curpw, $ds).'", '.$mysql_password_field . ')';
+ } elseif ($mysql_digest_md5_crypt) {
+ $query_string .= '=MD5("'.mysql_real_escape_string($username, $ds).'::'.mysql_real_escape_string($curpw, $ds).'")';
} else {
$query_string .= '="' . mysql_real_escape_string($curpw, $ds) . '"';
}
@@ -125,6 +128,8 @@
} elseif ($mysql_unixcrypt) {
// FIXME: use random salt when you create new password
$update_string .= '=encrypt("'.mysql_real_escape_string($newpw, $ds).'", '.$mysql_password_field . ')';
+ } elseif ($mysql_digest_md5_crypt) {
+ $update_string .= '=MD5("'.mysql_real_escape_string($username, $ds).'::'.mysql_real_escape_string($newpw, $ds).'")';
} else {
$update_string .= '="' . mysql_real_escape_string($newpw, $ds) . '"';
}
signature.asc
(application/pgp-signature, 197 B)
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iEUEABECAAYFAkjHRQ4ACgkQqgiI2AvpPQJ6ZwCgjjbY9qpLdirDP3KHAUvvahTZ Y1EAlAgur5CotoQxpfqndanOkKGQnVQ= =0vD6 -----END PGP SIGNATURE-----