tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Hash editor passwords with Argon2id and upgrade old hashes.

Browse Source 
Old hashes are replaced at login. Widen the column before deploying:

  ALTER TABLE editors MODIFY password VARCHAR(255) NOT NULL;
This commit is contained in:
tim
2026-09-25 21:41:36 +02:00
parent 15ad07423a
commit dfa6d71198
3 changed files with 66 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
publish/addeditor.php
+20 -3
View File
@@ -5,6 +5,8 @@ if ( ! isset($_SERVER['HTTPS'])) {
require_once("../session.lib.php");
$added = FALSE;
$csrf_failed = FALSE;
$hash_failed = FALSE;
$exists = FALSE;
if (!isset($_SESSION['editor'])) {
header("Location: https://xxx.org.za/publish/login");
return;
@@ -16,11 +18,20 @@ if (!isset($_SESSION['editor'])) {
$table = "editors";
$username = (string)($_POST['username'] ?? '');
$password = password_hash((string)($_POST['password'] ?? ''), PASSWORD_DEFAULT);
$password = password_hash((string)($_POST['password'] ?? ''), password_algorithm());
$email = (string)($_POST['email'] ?? '');
$found = $db->execute_query("SELECT username FROM $table WHERE username = ?", array($username));
$query = "INSERT INTO $table SET `username` = ?, `password` = ?, `email` = ?";
if ($result = $db->execute_query($query, array($username, $password, $email))) {
$added = TRUE;
if ($found && $found->fetch_assoc()) {
$exists = TRUE;
} else if ($result = $db->execute_query($query, array($username, $password, $email))) {
// If the password column cut the hash short, the editor could never log in
if (password_hash_is_stored($username, $password)) {
$added = TRUE;
} else {
$db->execute_query("DELETE FROM $table WHERE username = ?", array($username));
$hash_failed = TRUE;
}
$is_admin = TRUE;
}
open_db('close');
@@ -54,6 +65,12 @@ if (!isset($_SESSION['editor'])) {
<?php if ($csrf_failed) { ?>
<p><strong>Your session has expired. Please try again.</strong></p>
<?php } ?>
<?php if ($exists) { ?>
<p><strong>An editor with that username already exists.</strong></p>
<?php } ?>
<?php if ($hash_failed) { ?>
<p><strong>The editor was not added: the editors.password column is too short for the password hash. Widen it to VARCHAR(255).</strong></p>
<?php } ?>
<form action="<?= form_value("https://xxx.org.za".$_SERVER['REQUEST_URI']) ?>" method="post">
<?= csrf_field() ?>