From c036bafab7a43b2d3981ede8e49222522965183e Mon Sep 17 00:00:00 2001 From: Mischa POSLAWSKY Date: Thu, 14 Jun 2018 17:00:15 +0200 Subject: [PATCH] login/pass: encrypt user input in profile data Left cleartext for debugging, but prefer at least blowfish hashing. Assume PHP v5.5 to generate salts. --- login/pass.inc.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/login/pass.inc.php b/login/pass.inc.php index 483f8bb..cb2427e 100644 --- a/login/pass.inc.php +++ b/login/pass.inc.php @@ -36,7 +36,8 @@ function passform($user, $input = []) return "Zorg dat bij de bevestiging precies het zelfde wachtwoord staat."; } - if (!file_put_contents($pwfile, $input['newpass'])) { + $passstore = password_hash($input['newpass'], PASSWORD_DEFAULT); + if (empty($passstore) or !file_put_contents($pwfile, $passstore)) { return "Het nieuwe wachtwoord kon niet worden opgeslagen. Het oude wachtwoord is behouden."; } -- 2.30.0