From 51ec50b0d0ae5519d919f2cbcd8c35eb0afd8cc8 Mon Sep 17 00:00:00 2001
From: Mark Hoschek <admin@geocre.net>
Date: Thu, 16 Oct 2014 09:24:32 +0200
Subject: [PATCH] Increase password hash strength

---
 cms/config/sql/mysql.initial.sql      |   2 +-
 cms/config/sql/postgresql.initial.sql |   2 +-
 cms/data/content.sqlite               | Bin 393216 -> 393216 bytes
 cms/data/userdata.sqlite              | Bin 4096 -> 4096 bytes
 cms/includes/functions.admin.inc.php  |   8 ++++----
 5 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/cms/config/sql/mysql.initial.sql b/cms/config/sql/mysql.initial.sql
index 5f79f29..86a93f4 100644
--- a/cms/config/sql/mysql.initial.sql
+++ b/cms/config/sql/mysql.initial.sql
@@ -263,4 +263,4 @@ INSERT INTO phpsqlitecms_settings (name, value) VALUES ('admin_language', 'engli
 INSERT INTO phpsqlitecms_settings (name, value) VALUES ('default_page_language', 'english');
 INSERT INTO phpsqlitecms_settings (name, value) VALUES ('caching', '0');
 INSERT INTO phpsqlitecms_settings (name, value) VALUES ('wysiwyg_editor', '0');
-INSERT INTO phpsqlitecms_userdata (name, type, pw, last_login, wysiwyg) VALUES('admin', 1, '75470d05abd21fb5e84e735d2bc595e2f7ecc5c7a5e98ad0d7', 1230764400, 0);
+INSERT INTO phpsqlitecms_userdata (name, type, pw, last_login, wysiwyg) VALUES('admin', 1, '$6$rounds=5000$56748f4e35e993f6$nW05WLxf2aJGdiALJktlCvzrAXdxlvMLhRUmNAw1W42tqVLXoS0AGRrM41.sSRp3PrYpg4qsjOHGN22jKzPxA0', 1230764400, 0);
diff --git a/cms/config/sql/postgresql.initial.sql b/cms/config/sql/postgresql.initial.sql
index 137cbbb..48aa497 100644
--- a/cms/config/sql/postgresql.initial.sql
+++ b/cms/config/sql/postgresql.initial.sql
@@ -260,4 +260,4 @@ INSERT INTO phpsqlitecms_settings (name, value) VALUES ('default_page_language',
 INSERT INTO phpsqlitecms_settings (name, value) VALUES ('caching', '0');
 INSERT INTO phpsqlitecms_settings (name, value) VALUES ('wysiwyg_editor', '0');
 
-INSERT INTO phpsqlitecms_userdata (name, type, pw, last_login, wysiwyg) VALUES('admin', 1, '75470d05abd21fb5e84e735d2bc595e2f7ecc5c7a5e98ad0d7', 1230764400, 0);
+INSERT INTO phpsqlitecms_userdata (name, type, pw, last_login, wysiwyg) VALUES('admin', 1, '$6$rounds=5000$56748f4e35e993f6$nW05WLxf2aJGdiALJktlCvzrAXdxlvMLhRUmNAw1W42tqVLXoS0AGRrM41.sSRp3PrYpg4qsjOHGN22jKzPxA0', 1230764400, 0);
diff --git a/cms/data/content.sqlite b/cms/data/content.sqlite
index e4e78ebcc2d99f7ccf65c5504d827975e272dccd..0aa3a88912d286e108f56e8c6adbc0e22e70d156 100644
GIT binary patch
delta 306
zcmZo@kZ5R-m>|u#exi&s<NC&g)&$0_2~5lX*Gp83Rrggh*JhSas^O~9sI{zJSNpd%
zpzcy#WbMp4!8)}n)4JZOuzJPXr&aIkHdS`j6jYzB4=aCA`Mp}J_GlGbg>$V+EpN?_
znuj%WsuapURom1ARX?lVQN5tLx^i80Nd1utrmAUGr>bsN?yf7Yd|7#?s=l(YGP2UN
zQncdd)HY^*=56(CTW2skmoqNkey5!IG!uVy0Ruk+0!&|C#cVnKeHC*fcWomBH&kMJ
zK{d1O_8ryC8yTnD)-y|p*S%qoKxl%p>fTImsAXO;-Jy<o4NLtD2C0dTV$<K$F$YW!
gs|T8AXrO0kre|QOXK2y>sGb>!S++l_XO(LJ0GzOL#sB~S

delta 327
zcmZo@kZ5R-m>|u#Zla7c<GRL#)&$0_2~5lX*GpB4RX0~N*V~p)s^O~9sI{z}R{OLz
zpzcy#WNl;Z&pN&;)4JZOuzL2|vsLfwHdS`j6jYzB4=aCA`Mp}Jc5M|~g>$V+EpN?_
znuj%WsuapURom1ARX?lVQ9ZS~pmJSxNd1utrmAUGyQ@xB?yf7Yd|7#?s=l(YGP2UN
zQncdd)HY^*=H+#7w$5O7E@ynO{Z2XaX{PDhs+cYLtJgB{Ga$h9_f^b|)2pkQZMkbR
z8MvVm+jmqmZ)6m&(_oN5D21}>G^Wp}WnRHjKZ8MHqNB)khdSmp)7k2o10-jNu`ufk
zCg<norskCt#}}j)#TO)|ry3ee53Ofz;x@3*Gc?pQGSD+NY=2bG48$zkAJwzUH2?rs
Cp?Hn}

diff --git a/cms/data/userdata.sqlite b/cms/data/userdata.sqlite
index 57aaa8b52142887d2a2debb794c06dc1f69ca47a..ea8afa29a572b7722187f3f8397f0708ebdf5761 100644
GIT binary patch
delta 177
zcmZorXi%6S%~&~6#+k8lW5P0SjuHmu66P{y!_9&$3e1!B_}%IoIT<+^#2FhaSr`*j
zax?Q7Rm@b1@=Nnlifv5|3=C9E&CE?K(o9l~O;ar`jnm9j^1=;F!+k2!j1s-vQ!*WW
zys}GjoXe_;93xUHa>{&tGJ-;L{T#~;!%d7z3d4LN@`DW=-GhpJO$_ylgM$i;1BxOG
c(oG7Bv-~~W{fu~xvb?JTDjW?$><e-j07^bIM*si-

delta 103
zcmZorXi%6S%~&>3#+k8fW5P0Sj$I7QyO_(E4L1w2C@@df<9C}Fz{=<{vC(1jE_Qx%
zBO}wKWWzKIL&GEkbK}G`1LG7+3ro{9vlMf4b5p}q12YR#1M?(96O*LG6hp&A)70RX
HoQ(_s<x3p5

diff --git a/cms/includes/functions.admin.inc.php b/cms/includes/functions.admin.inc.php
index 570ef14..ba34e9a 100644
--- a/cms/includes/functions.admin.inc.php
+++ b/cms/includes/functions.admin.inc.php
@@ -7,10 +7,9 @@
  */
 function generate_pw_hash($pw)
  {
-  $salt = random_string(10,'0123456789abcdef');
-  $salted_hash = sha1($pw.$salt);
-  $hash_with_salt = $salted_hash.$salt;
-  return $hash_with_salt;
+  $salt = bin2hex(openssl_random_pseudo_bytes(22));
+  $hash = crypt($pw, '$6$rounds=5000$'.$salt.'$');
+  return $hash;
  }
 
 /**
@@ -29,6 +28,7 @@ function is_pw_correct($pw,$hash)
     if(sha1($pw.$salt)==$salted_hash) return true;
     else return false;
    }
+  elseif(crypt($pw, $hash) == $hash) return true;
   else return false;
  }