Unexpected behaviour changing plain text password login check code

leke · July 4, 2012

I'm modifying php event calendar and tried to add support for sha1 salted passwords. The check seems to return true, but the code to display the calendar fails if I use the new code (no error, just goes back to the original screen). Could someone have a look at the new and old functions responsible for the login? I've commented the changed lines with // changed.

I've also modified the calendar not to show unless $auth was true. Also included at the end. This is the one that doesn't evaluate $auth for some reason after the login.

Thanks.

function auth($login = '', $passwd = '') 
{

session_start();
$auth     = 0;
$register = false;
$authdata = null;

if (isset($_SESSION['authdata'])) {
	$authdata = $_SESSION['authdata'];
}

# return false if login neither passed to func, nor in session
if (empty($login) && empty($authdata['login'])) {
	return 0;
}

# get login passed to function
if (!empty($login)) {
	$username = $login;
	$pw       = $passwd;
	$salt = $pw; // changed
	$password_hash = sha1($salt.sha1($pw.$salt)); // changed
	$register = true;
} else {
	$username = $authdata['login'];
	$pw       = $authdata['password'];
}

mysql_connect(DB_HOST, DB_USER, DB_PASS) or die(mysql_error());
mysql_select_db(DB_NAME) or die(mysql_error());

$sql = "
	SELECT * FROM " . DB_TABLE_PREFIX . "users 
	WHERE username = '" . $username . "'";
$result = mysql_query($sql) or die(mysql_error());
$row = mysql_fetch_assoc($result);

# validate login, and register session data if appropriate 
if ( $password_hash == $row["password"] ) { // changed
	$auth = $row['userlevel'];

	if ($register) {
		$_SESSION['authdata'] = array(
			'login'     => $row['username'], 
			'password'  => $row['password'], 
			'userlevel' => $row['userlevel'], 
			'uid'       => $row['uid'],
		);
	}
} else {
	# if passwords didn't match, delete authdata session data 
	unset($_SESSION['authdata']);
}
   	return $auth;
}

function OLD_auth($login = '', $passwd = '') 
{
session_start();
$auth     = 0;
$register = false;
$authdata = null;

if (isset($_SESSION['authdata'])) {
	$authdata = $_SESSION['authdata'];
}

# return false if login neither passed to func, nor in session
if (empty($login) && empty($authdata['login'])) {
	return 0;
}

# get login passed to function
if (!empty($login)) {
	$username = $login;
	$pw       = $passwd;
	$register = true;
} else {
	$username = $authdata['login'];
	$pw       = $authdata['password'];
}

mysql_connect(DB_HOST, DB_USER, DB_PASS) or die(mysql_error());
mysql_select_db(DB_NAME) or die(mysql_error());

$sql = "
	SELECT * FROM " . DB_TABLE_PREFIX . "users 
	WHERE username = '" . $username . "'";
$result = mysql_query($sql) or die(mysql_error());
$row = mysql_fetch_assoc($result);

# validate login, and register session data if appropriate 
if ( $pw == $row["password"] ) {
	$auth = $row['userlevel'];

	if ($register) {
		$_SESSION['authdata'] = array(
			'login'     => $row['username'], 
			'password'  => $row['password'], 
			'userlevel' => $row['userlevel'], 
			'uid'       => $row['uid'],
		);
	}
} else {
	# if passwords didn't match, delete authdata session data 
	unset($_SESSION['authdata']);
}
   	return $auth;
}

...code to display the calendar...

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title></title>
<?php javaScript() ?>
<link rel="stylesheet" type="text/css" href="css/default.css">
</head>
<body>

<br><br>

<table cellpadding="0" cellspacing="0" border="0" align="center">

<?php 

if(!$auth){
echo "<tr><td><span style=\"font-size:xx-large; text-align:center; color:red; padding:100px;\">Please login to see the availability calendar.</span></td></tr>";
} else {
echo "<tr><td>";
echo $scrollarrows;
echo '<span class="date_header"> '; 
echo $lang['months'][$m-1];
echo ' '; 
echo $y;
echo '</span></td><!-- form tags must be outside of <td> tags --><form name="monthYear"><td align="right">';

monthPullDown($m, $lang['months']); 
yearPullDown($y);

echo '<input type="button" value="GO" onClick="submitMonthYear()"></td></form></tr><tr> <!-- This is the calendar layout --><td colspan="2" bgcolor="#000000">';

echo writeCalendar2($m, $y);
echo "</td></tr>";
}
?>

<tr>
<td colspan="2" align="center">
<?php echo footprint($auth, $m, $y) ?></td>
</tr>
</table>

</body>
</html>

leke · July 4, 2012

I've managed to follow it to

	
if ( $password_hash == $row["password"] ) { // changed
	$auth = $row['userlevel'];

	if ($register) {
		$_SESSION['authdata'] = array(
			'login'     => $row['username'], 
			'password'  => $row['password'], 
			'userlevel' => $row['userlevel'], 
			'uid'       => $row['uid'],
		);

All the data here is correct until it leaves the function. Then the $_SESSION['authdata'][...] data disappears (resets to $auth = 0;). But all the conditions were met, so I have no idea why it resets.

leke · July 5, 2012

Solved. Using a different variable later on did something to the session data. I can't find where $pw is used later on, but overwriting the value solved the problem.

Sign In

Unexpected behaviour changing plain text password login check code

Recommended Posts

leke

Link to comment

Share on other sites

leke

Link to comment

Share on other sites

leke

Link to comment

Share on other sites

Join the conversation

Browse

Activity

Important Information