Description Denis Roy 2009-08-27 11:41:26 EDT

Effective Saturday, the Bugzilla passwords that we rely on for authentication will change.  Passwords will be in crypt() format until the users log in, which will convert them to SHA-256.  Our auth code needs to determine whether the password used is based on crypt() or sha-256, so we need to pull the encrypted password from the DB, grep for a hash method, then compare it to the incoming password.

It should be noted that we can (and should) make the code change *NOW* since the code needs to detect current (crypt) passwords as well as SHA-256 ones.

IPZilla: I'll diff/patch the 3.0 bz_crypt method with the 3.4, and that should be sufficient.  I'll likely need to install Digest and Digest::SHA on the nodes.

PHP: This should work:
$db_cryptpassword = "SELECT cryptpassword from profiles where login_name = '" . addslashes($form_email) . "' AND disabledtext = ''";

if(preg_match("/{([^}]+)}$/", $db_cryptpassword, $matches)) {
  $hash = $matches[0];
  $salt = substr($db_cryptpassword,0,8);
  # Use one or the other, depending on server libs
  $pw = $salt . str_replace("=", "", base64_encode(hash("sha256", $form_password . $salt, true))) . $hash;
  $pw2 = $salt . str_replace("=", "", base64_encode(mhash(MHASH_SHA256,$form_password . $salt))) . $hash;
}
else {
  $pw = crypt($form_password, $db_cryptpassword);
}

if($db_cryptpassword == $pw) {
  echo "Login successful";
}

List of sites to change:
- IPZilla (perl)
- Site Login (php)
- Babel (php)
- Live (php)
- EPIC/Marketplace (php)
- Submission system?

- Blogs, Forums & Wiki use the site login