Changeset 3231:bf7f869cfed9 for inc/prepend.php

Timestamp:

03/25/16 12:43:18 (9 years ago)

Author:

franck <carnet.franck.paul@…>

Branch:

default

Message:

Allow different cryptographic algorithm for user password, choosen algo must provide result longer or equal than 40 characters (as default sha1), closes #1922

The constant DC_CRYPT_ALGO should be defined in config.php, and users will have to use recovery password procedure to set a new one according to the choosen algorithm.

File:

• inc/prepend.php (modified) (1 diff)

inc/prepend.php

@@ -191 +191 @@
 }
 
+if (!defined('DC_CRYPT_ALGO')) {
+     define('DC_CRYPT_ALGO','sha1');    // As in Dotclear 2.9 and previous
+} else {
+     // Check length of cryptographic algorithm result and exit if less than 40 characters long
+     if (strlen(crypt::hmac(DC_MASTER_KEY,DC_VENDOR_NAME,DC_CRYPT_ALGO)) < 40) {
+          if (!defined('DC_CONTEXT_ADMIN')) {
+               exit('Site temporarily unavailable');
+          } else {
+               exit(DC_CRYPT_ALGO.' cryptographic algorithm configured is not strong enough, please change it.');
+          }
+     }
+}
+
 l10n::init();