Changeset 7732

Show
Ignore:
Timestamp:
05/15/09 13:46:04 (3 years ago)
Author:
xrobau
Message:

I managed to forget to change the ampusers page. Wups. Sorry. Adding, Removing and Editing users now works.

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • modules/branches/2.6/core/functions.inc.php

    r7682 r7732  
    25042504 
    25052505function core_ampusers_add($username, $password, $extension_low, $extension_high, $deptname, $sections) { 
    2506   $sql = "INSERT INTO ampusers (username, password, extension_low, extension_high, deptname, sections) VALUES ("; 
     2506  $sql = "INSERT INTO ampusers (username, password_sha256, extension_low, extension_high, deptname, sections) VALUES ("; 
    25072507  $sql .= "'".$username."',"; 
    2508   $sql .= "'".$password."',"; 
     2508  if (strlen($password) == 64) { 
     2509    // It's already a hash 
     2510    $sql .= "'".$password."'"; 
     2511  } else { 
     2512    // Hash it. 
     2513    $sql .= "'".hash("sha256", $password)."',"; 
     2514  } 
    25092515  $sql .= "'".$extension_low."',"; 
    25102516  $sql .= "'".$extension_high."',"; 

  • modules/branches/2.6/core/page.ampusers.php

    r7630 r7732  
    2323$tech = isset($_REQUEST['tech'])?$_REQUEST['tech']:''; 
    2424 
     25$tabindex = 0; 
    2526// populate some global variables from the request string 
    2627$set_globals = array("username","password","extension_high","extension_low","deptname"); 
    …… 
    3031  } 
    3132} 
     33$form_password_sha256 = stripslashes(isset($_REQUEST['password_sha256'])?$_REQUEST['password_sha256']:''); 
    3234 
    3335//Search ALL active modules while generating admin access list 
    …… 
    8486  break; 
    8587  case "editampuser": 
    86     core_ampusers_del($userdisplay); 
    87     core_ampusers_add($username, $password, $extension_low, $extension_high, $deptname, $sections); 
     88    // Check to make sure the hidden var is sane, and that they haven't change the password field 
     89    if (strlen($form_password_sha256)==64 && $password == "******") { 
     90      // Password unchanged 
     91      core_ampusers_del($userdisplay); 
     92      core_ampusers_add($username, $form_password_sha256, $extension_low, $extension_high, $deptname, $sections); 
     93    } elseif ($password != "******") { 
     94      // Password has been changed 
     95      core_ampusers_del($userdisplay); 
     96      core_ampusers_add($username, $password, $extension_low, $extension_high, $deptname, $sections); 
     97    } 
    8898    //indicate 'need reload' link in footer.php  
    8999    needreload(); 
    …… 
    126136     
    127137    $username = $user["username"]; 
    128     $password = $user["password"]; 
     138    $password = "******"; 
     139    $password_sha256 = $user["password_sha256"]; 
    129140    $extension_high = $user["extension_high"]; 
    130141    $extension_low = $user["extension_low"]; 
    …… 
    159170      <input type="hidden" name="action" value=""/> 
    160171      <input type="hidden" name="tech" value="<?php echo $tech?>"/> 
     172      <input type="hidden" name="password_sha256" value="<?php echo $password_sha256 ?>"/> 
    161173      <table> 
    162174      <tr> 
    …… 
    183195          <a href=# class="info"><?php echo _("Password<span>Create a password for this new user</span>")?></a>:  
    184196        </td><td> 
    185           <input type="password" size="20" name="password" value="<?php echo $password;?>" tabindex="<?php echo ++$tabindex;?>"/> 
     197          <input type="password" size="20" name="password" value="<? echo $password; ?>" tabindex="<?php echo ++$tabindex;?>"/> 
    186198        </td> 
    187199      </tr>