Changeset 308 for trunk/includes/global_function.php

Timestamp:

Jan 31, 2010, 9:41:08 AM (14 years ago)

Author:

george

Message:

• Upraveno: Posílení bezpečnosti hesel pomocí připojování náhodných dat Salt k hashovanému heslu.
• Opraveno: Mazání úloh exportu, které odkazují na již smazaný export.

File:

• trunk/includes/global_function.php (modified) (2 diffs)

trunk/includes/global_function.php

@@ -208 +208 @@
   if(isset($_SESSION['User']) and ($_SESSION['User'] <> '') and ($_SESSION['UserID'] != '')) 
   {
-    //  $User = $_SESSION['User'];
+    // $User = $_SESSION['User'];
     $Pass = $_SESSION['Pass'];
-    $Line = mysql_fetch_array($Database->SQLCommand('SELECT * FROM user WHERE ID = '.$_SESSION['UserID'].'
-      AND GM >= '.$Licence.' AND pass = sha1("'.$Pass.'")'));
-    //  echo "SELECT * FROM user WHERE ID = ".$_SESSION['UserID']." AND GM <= $Licence AND pass = '$Pass'";
+    $Line = mysql_fetch_array($Database->SQLCommand('SELECT * FROM user WHERE ID = '.$_SESSION['UserID'].' AND GM >= '.$Licence.' AND pass = sha1(CONCAT(sha1("'.$Pass.'"), Salt))'));
     return($Line);
   } else 
@@ -547 +545 @@
 }
 
+function GetPasswordSalt()
+{
+  return(substr(sha1(mt_rand()), 0, 8));
+}
 
 ?>