#25 clear-text password

[Joao Inacio]

I was surprised to see my password in the author's
table as clear-text, so the first thing i did was
change it to use md5.

bBlogClass.php:

function userauth($user, $pass, $setcookie =
FALSE) {
$query = "SELECT `id` FROM `".T_AUTHORS."`
WHERE `nickname`='".my_addslashes($user)."' AND
`password`= '".my_addslashes($pass)."'";

to
... `password`= md5('".my_addslashes($pass)."')";

IMHO storing passwords safely is not only a feature,
but a requirement, so i submited it as a bug :)

Cheers
Joao Inacio

[Anonymous]

Logged In: YES
user_id=1037458

Thanks. This has been fixed in both 0.7.5's CVS and the
latest CVS too.