From ffb04de2302e6cc71c0aa80e6e1fa2ee73a6a3c9 Mon Sep 17 00:00:00 2001
From: Marius Cramer <m.cramer@pixcept.de>
Date: Sat, 25 Apr 2015 11:11:28 -0400
Subject: [PATCH] - Changed password generation function - Fixed password length in lost password function
---
interface/lib/classes/auth.inc.php | 43 +++++++++++++++++++++++++++++++++++++------
interface/web/login/password_reset.php | 8 ++++++--
2 files changed, 43 insertions(+), 8 deletions(-)
diff --git a/interface/lib/classes/auth.inc.php b/interface/lib/classes/auth.inc.php
index ae626b7..9640a4b 100644
--- a/interface/lib/classes/auth.inc.php
+++ b/interface/lib/classes/auth.inc.php
@@ -174,13 +174,44 @@
}
- public function get_random_password($length = 8) {
- $base64_alphabet='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
- $password = '';
- for ($n=0;$n<$length;$n++) {
- $password.=$base64_alphabet[mt_rand(0, 63)];
+ public function get_random_password($minLength = 8, $special = false) {
+ $minLength = $minLength || 10;
+ if($minLength < 8) $minLength = 8;
+ $maxLength = $minLength + 5;
+ $length = mt_rand($minLength, $maxLength);
+
+ $alphachars = "abcdefghijklmnopqrstuvwxyz";
+ $upperchars = "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
+ $numchars = "1234567890";
+ $specialchars = "!@#_";
+
+ $num_special = 0;
+ if($special == true) {
+ $num_special = intval(mt_rand(0, round($length / 4))) + 1;
}
- return $password;
+ $numericlen = mt_rand(1, 2);
+ $alphalen = $length - $num_special - $numericlen;
+ $upperlen = intval($alphalen / 2);
+ $alphalen = $alphalen - $upperlen;
+ $password = '';
+
+ for($i = 0; $i < $alphalen; $i++) {
+ $password .= substr($alphachars, mt_rand(0, strlen($alphachars) - 1), 1);
+ }
+
+ for($i = 0; $i < $upperlen; $i++) {
+ $password .= substr($upperchars, mt_rand(0, strlen($upperchars) - 1), 1);
+ }
+
+ for($i = 0; $i < $num_special; $i++) {
+ $password .= substr($specialchars, mt_rand(0, strlen($specialchars) - 1), 1);
+ }
+
+ for($i = 0; $i < $numericlen; $i++) {
+ $password .= substr($numchars, mt_rand(0, strlen($numchars) - 1), 1);
+ }
+
+ return str_shuffle($password);
}
public function crypt_password($cleartext_password) {
diff --git a/interface/web/login/password_reset.php b/interface/web/login/password_reset.php
index 9625934..683a4bc 100644
--- a/interface/web/login/password_reset.php
+++ b/interface/web/login/password_reset.php
@@ -60,7 +60,11 @@
$app->tpl->setVar("error", $wb['lost_password_function_disabled_txt']);
} else {
if($client['client_id'] > 0) {
- $new_password = $app->auth->get_random_password();
+ $server_config_array = $app->getconf->get_global_config();
+ $min_password_length = 8;
+ if(isset($server_config_array['misc']['min_password_length'])) $min_password_length = $server_config_array['misc']['min_password_length'];
+
+ $new_password = $app->auth->get_random_password($min_password_length, true);
$new_password_encrypted = $app->auth->crypt_password($new_password);
$username = $client['username'];
@@ -69,7 +73,7 @@
$app->tpl->setVar("message", $wb['pw_reset']);
$app->uses('getconf,ispcmail');
- $mail_config = $app->getconf->get_global_config('mail');
+ $mail_config = $server_config_array['mail'];
if($mail_config['smtp_enabled'] == 'y') {
$mail_config['use_smtp'] = true;
$app->ispcmail->setOptions($mail_config);
--
Gitblit v1.9.1