tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Hash the password for an unknown username at login.

Browse Source 
An unknown username got a fast answer, which showed which usernames exist.
This commit is contained in:
tim
2026-09-26 15:27:51 +02:00
parent c8030b759d
commit 061f9c1a37
3 changed files with 42 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
publish/login.php
+3 -4
View File
@@ -29,14 +29,13 @@ if (isset($_SESSION['editor'])) {
$getid = $db->execute_query($query, array($username)) or db_fail();
$row = $getid->fetch_assoc();
$stored_password = '';
$stored_password = NULL;
if (isset($row))
$stored_password = $row['password'];
$stored_password = (string)$row['password'];
else $denied = TRUE;
$getid->close();
$compare_password = is_string($_POST['password'] ?? NULL) ? $_POST['password'] : '';
// password_verify() also accepts hashes made by the old crypt() call
if (!password_verify($compare_password, $stored_password)) {
if (!editor_password_valid($compare_password, $stored_password)) {
$denied = TRUE;
record_login_failure($username);
open_db('close');