Ticket #1217: xtc_validate_password.inc.php

File xtc_validate_password.inc.php, 3.5 KB (added by Volker Strähle, 9 years ago)
Line 
1<?php
2/* -----------------------------------------------------------------------------------------
3 $Id$
4
5 modified eCommerce Shopsoftware
6 http://www.modified-shop.org
7
8 Copyright (c) 2009 - 2013 [www.modified-shop.org]
9 -----------------------------------------------------------------------------------------
10 based on:
11 (c) 2000-2001 The Exchange Project (earlier name of osCommerce)
12 (c) 2002-2003 osCommerce(password_funcs.php,v 1.10 2003/02/11); www.oscommerce.com
13 (c) 2003 nextcommerce (xtc_validate_password.inc.php,v 1.4 2003/08/13); www.nextcommerce.org
14 (c) 2003 XT-Commerce
15
16 Released under the GNU General Public License
17 ---------------------------------------------------------------------------------------*/
18
19 // include needed class
20 require_once (DIR_FS_CATALOG.'includes/classes/validpass.php');
21
22 // This funstion validates a plain text password with an encrpyted password
23 function xtc_validate_password($plain, $encrypted, $customers_id) {
24 if (xtc_not_null($plain) && xtc_not_null($encrypted)) {
25
26 $check = xtc_validate_password_collation($plain, $encrypted, $customers_id);
27 if ($check === false) {
28 $plain = mb_convert_encoding($plain, 'ISO-8859-15', 'UTF-8');
29 $check = xtc_validate_password_collation($plain, $encrypted, $customers_id);
30 }
31
32 return $check;
33 }
34 }
35
36 function xtc_validate_password_collation($plain, $encrypted, $customers_id) {
37 if (xtc_not_null($plain) && xtc_not_null($encrypted)) {
38 // check for old passwords
39 if (preg_match('#^[a-z0-9]{32}$#i', $encrypted)) {
40 if ($encrypted != md5($plain)) {
41 return false;
42 } elseif ($customers_id) {
43 // update Database
44 xtc_db_query("ALTER TABLE ".TABLE_CUSTOMERS." MODIFY customers_password varchar(60) NOT NULL");
45 // auth is correct, so update to new password hash
46 require_once (DIR_FS_INC . 'xtc_encrypt_password.inc.php');
47 xtc_db_query("UPDATE " . TABLE_CUSTOMERS . "
48 SET customers_password = '" . xtc_encrypt_password($plain) . "'
49 WHERE customers_id = '" . (int)$customers_id . "'");
50 }
51 return true;
52 } else {
53 $blowfish_type = substr($encrypted,0,4);
54 $blowfish_iter = substr($encrypted,4,2);
55 // init class
56 $validpass = new validpass($blowfish_iter, false, $blowfish_type);
57 // validate password
58 $validpass_result = $validpass->validate_password($plain, $encrypted);
59 /*
60 if (($validpass_result == true) && ($blowfish_type !== '$2y$') && ($customers_id)){
61 require_once (DIR_FS_INC . 'xtc_encrypt_password.inc.php');
62 xtc_db_query("UPDATE " . TABLE_CUSTOMERS . "
63 SET customers_password = '" . xtc_encrypt_password($plain, 10, false, '$2y$') . "'
64 WHERE customers_id = '" . (int)$customers_id . "'");
65
66 }
67 */
68 defined('PWD_ENCRYPTION') or define('PWD_ENCRYPTION', '$2y$'); // todo: Move to config
69 defined('PWD_ENC_ITERATION') or define('PWD_ENC_ITERATION', '10'); // todo: Move to config
70 if (($validpass_result == true) && ($blowfish_type !== PWD_ENCRYPTION) && ($customers_id)){
71 require_once (DIR_FS_INC . 'xtc_encrypt_password.inc.php');
72 xtc_db_query("UPDATE " . TABLE_CUSTOMERS . "
73 SET customers_password = '" . xtc_encrypt_password($plain, PWD_ENC_ITERATION, false, PWD_ENCRYPTION) . "'
74 WHERE customers_id = '" . (int)$customers_id . "'");
75
76 }
77 return $validpass_result;
78 }
79 }
80 }
81?>