prehistoric-systems/mytinytodo
1
0
Fork 0
mirror of https://github.com/maxpozdeev/mytinytodo.git synced 2026-03-11 08:55:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

+ Password is stored as hash

Browse source
This commit is contained in:
Max Pozdeev 2022-02-06 14:08:15 +03:00
parent 4988741e62
commit 553a66651c
5 changed files with 36 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
src/ajax.php
View file

@ -306,8 +306,7 @@ elseif(isset($_POST['login']))
$t['disabled'] = 1;
jsonExit($t);
}
$password = _post('password');
if($password == Config::get('password')) {
if ( isPasswordEqualsToHash(_post('password'), Config::get('password')) ) {
$t['logged'] = 1;
session_regenerate_id(1);
$_SESSION['logged'] = 1;

3
src/includes/class.config.php
View file

@ -105,6 +105,9 @@ class Config
$key = 'db.driver';
$val = 'mysqli';
}
elseif ($key == 'password' && $val != '') {
$val = passwordHash($val); // in v1.7 password is hashed
}
// if (!isset(self::$dbparams[$key])) {
// throw new Exception("Unknown key: $key");
// }

24
src/includes/common.php
View file

@ -122,4 +122,28 @@ function generateUUID(): string
);
}
function passwordHash(string $p): string
{
if ($p == '') return '';
return 'sha256:'. hash('sha256', $p);
}
/**
* Compares raw (not hashed) password with password hash. Return true if equals.
* @param string $p Raw password
* @param string $hash Password hash
* @return bool
*/
function isPasswordEqualsToHash(string $p, string $hash): bool
{
if ($hash == '' && $p == '') return true;
if ($hash == '' || $p == '') return false;
if ( false !== $pos = strpos($hash, ':') ) {
$algo = substr($hash, 0, $pos);
if ($algo != 'sha256') throw new Exception("Unsupported algo of password hash");
if ( hash_equals($hash, passwordHash($p)) ) return true;
}
return false;
}
?>

10
src/init.php
View file

@ -108,25 +108,25 @@ function requireConfig()
}
}
function need_auth()
function need_auth(): bool
{
return (Config::get('password') != '') ? 1 : 0;
return (Config::get('password') != '') ? true : false;
}
function is_logged()
function is_logged(): bool
{
if ( !need_auth() ) return true;
if ( isset($_SESSION['logged']) && $_SESSION['logged'] ) return true;
return false;
}
function is_readonly()
function is_readonly(): bool
{
if ( !is_logged() ) return true;
return false;
}
function access_token()
function access_token(): string
{
if (!need_auth()) return '';
if (!isset($_SESSION)) return '';

5
src/settings.php
View file

@ -30,8 +30,9 @@ if(isset($_POST['save']))
jsonExit($t);
}
if(isset($_POST['password']) && $_POST['password'] != '') Config::set('password', $_POST['password']);
elseif(!_post('allowpassword')) Config::set('password', '');
if (isset($_POST['password']) && $_POST['password'] != '') Config::set('password', passwordHash($_POST['password'])) ;
elseif (!_post('allowpassword')) Config::set('password', '');
Config::set('smartsyntax', (int)_post('smartsyntax'));
// Do not set invalid timezone
try {