tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Hash editor passwords with Argon2id and upgrade old hashes.

Browse Source 
Old hashes are replaced at login. Widen the column before deploying:

  ALTER TABLE editors MODIFY password VARCHAR(255) NOT NULL;
This commit is contained in:
tim
2026-09-25 21:41:36 +02:00
parent 15ad07423a
commit dfa6d71198
3 changed files with 66 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
publish/login.php
+5 -2
View File
@@ -26,12 +26,15 @@ if (isset($_SESSION['editor'])) {
$stored_password = $row['password'];
else $denied = TRUE;
$getid->close();
open_db('close');
$compare_password = $_POST['password'] ?? '';
$compare_password = is_string($_POST['password'] ?? NULL) ? $_POST['password'] : '';
// password_verify() also accepts hashes made by the old crypt() call
if (!password_verify($compare_password, $stored_password)) {
$denied = TRUE;
open_db('close');
} else {
// Move an old hash to the current algorithm while we have the password
rehash_password($username, $compare_password, $stored_password);
open_db('close');
login_editor($username);
// Keep user logged in with cookie, if they request it
if (isset($_POST['remember'])) {