Subversion Repositories personal-webbase

Rev

Rev 4 | Go to most recent revision | Show entire file | Regard whitespace | Details | Blame | Last modification | View Log | RSS feed

Rev 4 Rev 11
Line 17... Line 17...
17 
 
 17 
 
18 
  $res = db_query("SELECT `username`, `passwort`, `fastlogin_secret`, `last_login`, `last_login_ip` FROM `".$mysql_zugangsdaten['praefix']."users` WHERE `gesperrt` = '0' AND `fastlogin_secret` != ''");
 18 
  $res = db_query("SELECT `username`, `passwort`, `fastlogin_secret`, `last_login`, `last_login_ip` FROM `".$mysql_zugangsdaten['praefix']."users` WHERE `gesperrt` = '0' AND `fastlogin_secret` != ''");
19 
  while ($row = db_fetch($res))
 19 
  while ($row = db_fetch($res))
20 
  {
 20 
  {
21 
    // Gastzugang verbieten. Es wird nicht geprüft, ob Gastaccount aktiviert ist oder nicht. (siehe user_login)
 21 
    // Gastzugang verbieten. Es wird nicht geprüft, ob Gastaccount aktiviert ist oder nicht. (siehe user_login)
22 
    if (($row['username'] != $konfiguration['main_gastzugang']['gast_username']) && ($row['passwort'] != md5($konfiguration['main_gastzugang']['gast_passwort'])))
 22 
    if (($row['username'] != $konfiguration['main_gastzugang']['gast_username']) && ($row['passwort'] != md5($konfiguration['main_gastzugang']['gast_passwort']))) // TODO: use sha3 hash, salted and peppered
23 
    {
 23 
    {
24 
      $dec = ib_decrypt($secretkey, $row['fastlogin_secret']);
 24 
      $dec = ib_decrypt($secretkey, $row['fastlogin_secret']);
25 
      $ary = explode("\n", $dec);
 25 
      $ary = explode("\n", $dec);
26 
 
 26 
 
27 
      if ((count($ary) == 4))
 27 
      if ((count($ary) == 4))
28 
      {
 28 
      {
29 
        if ((    $ary[0]  == $row['username']) && ($ary[1] == special_hash($ary[0])) &&
 29 
        if ((    $ary[0]  == $row['username']) && ($ary[1] == special_hash($ary[0])) &&
30 
            (md5($ary[2]) == $row['passwort']) && ($ary[3] == special_hash($ary[2]))    )
 30 
            (md5($ary[2]) == $row['passwort']) && ($ary[3] == special_hash($ary[2]))    ) // TODO: use sha3 hash, salted and peppered
31 
        {
 31 
        {
32 
          $erfolg = 1;
 32 
          $erfolg = 1;
33 
          break;
 33 
          break;
34 
        }
 34 
        }
35 
      }
 35 
      }