Wed 27 Apr 2005 01:33:52 PM UTC, comment #7:
I had the same problem and solved it this way (I'm using Biborb 1.3.2)
$BIBORB_PATH/php/auth_backends/crypt_password.php, line 8, uses the php-function "crypt" to encrypt the password:
> echo "Encrypted password: ".crypt($_POST['password']);
Looking in its definition (http://www.php.net/manual/en/function.crypt.php), there is an optional second argument called 'salt' for this function:
> string crypt ( string str [, string salt] )
The encryption (MD5, DES,...)used by this function depends on your system and is triggered by the second argument 'salt':
> If the salt argument is not provided, one will be randomly
> generated by PHP each time you call this function.
In my case, each time I reloaded the crypt_password.php, I got a different encrypted password for the same cleartext password. My solution was to add the password itself as salt for the crypt-function, so I changed line 8 of crypt_password.php to
> echo "Encrypted password: ".crypt($_POST['password'], $_POST['password']);
I did not catch in detail what the 'salt' is exactly used for, but seems like this modification does the job - also concerning that in php/auth_backends/auth.file.php, line 70, the crypt function seems to be used in the same way:
> return (crypt($pass,$match[2]) == $match[2]);
|