bugBibORB - Bugs: bug #11899, Authentication via files failed

 
 

bug #11899: Authentication via files failed

Submitted by:  None
Submitted on:  Tue 08 Feb 2005 01:33:20 PM UTC  
 
Category: AuthenticationSeverity: 3 - Normal
Item Group: ErrorsStatus: Fixed
Assigned to: Guillaume Gardey <ggardey>Open/Closed: Closed
Release: 1.3.2-RC1Fixed Release: None
Planned Release: None

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Wed 27 Apr 2005 01:33:52 PM UTC, comment #7:

I had the same problem and solved it this way (I'm using Biborb 1.3.2)

$BIBORB_PATH/php/auth_backends/crypt_password.php, line 8, uses the php-function "crypt" to encrypt the password:

> echo "Encrypted password: ".crypt($_POST['password']);


Looking in its definition (http://www.php.net/manual/en/function.crypt.php), there is an optional second argument called 'salt' for this function:

> string crypt ( string str [, string salt] )


The encryption (MD5, DES,...)used by this function depends on your system and is triggered by the second argument 'salt':

> If the salt argument is not provided, one will be randomly
> generated by PHP each time you call this function.


In my case, each time I reloaded the crypt_password.php, I got a different encrypted password for the same cleartext password. My solution was to add the password itself as salt for the crypt-function, so I changed line 8 of crypt_password.php to

> echo "Encrypted password: ".crypt($_POST['password'], $_POST['password']);


I did not catch in detail what the 'salt' is exactly used for, but seems like this modification does the job - also concerning that in php/auth_backends/auth.file.php, line 70, the crypt function seems to be used in the same way:

> return (crypt($pass,$match[2]) == $match[2]);

Dominik Benz <dbenz>
Fri 25 Feb 2005 08:48:50 AM UTC, comment #6:

I attached a new patch. The old one contained some wrong path (exact for the 1.3.3 release but not for the 1.3.2)

Guillaume Gardey <ggardey>
Project AdministratorIn charge of this item.
Tue 22 Feb 2005 10:52:46 AM UTC, comment #5:

Hi, i got the following error while using the patches you suggested here:

Warning: file(./data/auth_files/bib_users.txt): failed to open stream: No such file or directory in /var/www/biborb/php/auth_backends/auth.file.php on line 74

Warning: Invalid argument supplied for foreach() in /var/www/biborb/php/auth_backends/auth.file.php on line 75

Login failed ....

Anonymous
Thu 17 Feb 2005 08:01:22 AM UTC, comment #4:

Hi,

it worked finally! :-) I noticed, that the generated md5 pwds now look different. They do not start with " $1$ " and
do not contain " / . " anymore. Maybe it helps... Thanks for your support.

Anonymous
Thu 10 Feb 2005 10:05:45 PM UTC, comment #3:

mm... I had a look and don't understand why it doesn't work with md5 passwords.
I come with a quick but not satisfactory solution by specifically use md5 in the php scripts.
I attached two files, crypt_password.php (generate md5 passwords) and a new auth.file.php that uses md5.
I hope it will work.

Guillaume

Guillaume Gardey <ggardey>
Project AdministratorIn charge of this item.
Thu 10 Feb 2005 10:41:04 AM UTC, comment #2:

Thx for quick response. I overwrote the existing file with the one you provided but the problem still exists. I generated new pwds and doublechecked the entries in bib_access.txt and bib_users.txt. Login failed all the time.

Anonymous
Tue 08 Feb 2005 06:03:20 PM UTC, comment #1:

There is a bug in the 1.3.2 release with mds5 password (fixed in the coming 1.3.3 release - a Release Candidate is available for testing).
For the 1.3.2 release, you can modify the line 68 of file php/auth_backends/auth.file.php by:

if(preg_match("/\s(\w)\s:\s(\S)\s/",$line,$match)){

(\S instead of \w)

Alternatively I attached the patched version. This should solve the authentication problem.

Guillaume

Guillaume Gardey <ggardey>
Project AdministratorIn charge of this item.
Tue 08 Feb 2005 01:33:20 PM UTC, original submission:

tried to activate auth via files. Used /php/authbackends/crypt_passwords.php to generate the crypted pw. (Example : pw : aaaa , output from crypt_passwords.php : -> $1$zK20EkHU$2pVw2hE1Qvr3TaRxzAl9G. <-

copied and pasted that into bib_users.txt
-> testuser:$1$zK20EkHU$2pVw2hE1Qvr3TaRxzAl9G.,0

saved.

changend config.php

tried to login, always get the message : Wrong username or password!

any ideas ? thx in advance. btw : used BibORB 1.3.2 release, 26 October 2004 not RC1

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #2615:  md5-auth-2.zip added by ggardey (3KiB - application/octet-stream - MD5 authentication for BibORB 1.3.2)
file #2535:  md5-auth.zip added by ggardey (3KiB - application/zip)
file #2529:  auth.file.php.gz added by ggardey (1KiB - application/x-tar)

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

Follow 6 latest changes.

Date Changed By Updated Field Previous Value => Replaced By
Sun 15 May 2005 08:08:29 AM UTCggardeyStatusNone=>Fixed
  Open/ClosedOpen=>Closed
Fri 25 Feb 2005 08:48:50 AM UTCggardeyAttached File-=>Added md5-auth-2.zip, #2237
Thu 10 Feb 2005 10:05:45 PM UTCggardeyAttached File-=>Added md5-auth.zip, #2178
Tue 08 Feb 2005 06:03:20 PM UTCggardeyAssigned toNone=>ggardey
  Attached File-=>Added auth.file.php.gz, #2172

Back to the top


Powered by Savane 3.1-cleanup1