Merge branch 'patch-1' into 'master'

Marius Burkard

2016-03-30 e004715f9a4eea0eeb7eb5c620ff3e973696d5e7

Merge branch 'patch-1' into 'master'

Support different Crypt Hash Algorithms

Support different hashing algorithms by just checking if the saved password starts with $ or not.
No computation of salt needed, just use saved password.

See merge request !304

 interface/web/login/index.php

@@ -157,9 +157,8 @@
                    $user = false;
                    if($mailuser) {
                        $saved_password = stripslashes($mailuser['password']);
                        $salt = '$1$'.substr($saved_password, 3, 8).'$';
                        //* Check if mailuser password is correct
                        if(crypt(stripslashes($password), $salt) == $saved_password) {
                        if(crypt(stripslashes($password), $saved_password) == $saved_password) {
                            //* we build a fake user here which has access to the mailuser module only and userid 0
                            $user = array();
                            $user['userid'] = 0;
@@ -182,22 +181,15 @@
                    $user = $app->db->queryOneRecord($sql, $username);
                    if($user) {
                        $saved_password = stripslashes($user['passwort']);
                        if(substr($saved_password, 0, 3) == '$1$') {
                            //* The password is crypt-md5 encrypted
                            $salt = '$1$'.substr($saved_password, 3, 8).'$';
                                if(crypt(stripslashes($password), $salt) != $saved_password) {
                                $user = false;
                            }
                        } elseif(substr($saved_password, 0, 3) == '$5$') {
                            //* The password is crypt-sha256 encrypted
                            $salt = '$5$'.substr($saved_password, 3, 16).'$';
                                if(crypt(stripslashes($password), $salt) != $saved_password) {
                        if(substr($saved_password, 0, 1) == '$') {
                            //* The password is encrypted with crypt
                            if(crypt(stripslashes($password), $saved_password) != $saved_password) {
                                $user = false;
                            }
                        } else {
                                //* The password is md5 encrypted
                            //* The password is md5 encrypted
                            if(md5($password) != $saved_password) {
                                    $user = false;
                                $user = false;
                            }
                        }
                    } else {