I have made some moifications to the base code that fix this
problem and switch to using the md5 hash for passwords
instead of using the inbuilt mysql password function.
One thing to note is that the md5 function generates a hash
for blank passwords where the mysql function does not. This
means that if you have already imported users from a
spreadsheet or have any users in your employees table you
will have to reset the UserPass field to the md5 hash for a
blank password so they can login. At this point the user may
then change their password to whatever they like via the
normal mechanism. If you have a blank database then this
problem will only arise for the default admin user as the
import code has been altered to hash the password field as
well.
Using md5 means the Employees.UserPass field also needs to
be changed to VARCHAR(32).
There are still further changes that I need to make however
the basics are.
1) Changed fieldlength of Employees.UserPass to VARCHAR
(32) to allow the storage
of md5 encrypted passwords. Previous password support
utilised the MySQL
password fuction and field length was insufficient
to store the encrypted
password this resulting in a login failure when
password was changed to a
non-blank string.
2) Modified Employee password encryption to md5 as opposed
to mysql password
encryption. Changes were as follows:
misc.php
134: $sql = "SELECT AccessLevel, Id FROM " .
$emp_db . "Employees WHERE LoginName='" . $login . "' and
UserPass='" . md5($pass) . "' AND Active=1;";
141: $activepass = md5($pass);
Logged In: YES
user_id=838560
Hi,
I have made some moifications to the base code that fix this
problem and switch to using the md5 hash for passwords
instead of using the inbuilt mysql password function.
One thing to note is that the md5 function generates a hash
for blank passwords where the mysql function does not. This
means that if you have already imported users from a
spreadsheet or have any users in your employees table you
will have to reset the UserPass field to the md5 hash for a
blank password so they can login. At this point the user may
then change their password to whatever they like via the
normal mechanism. If you have a blank database then this
problem will only arise for the default admin user as the
import code has been altered to hash the password field as
well.
Using md5 means the Employees.UserPass field also needs to
be changed to VARCHAR(32).
There are still further changes that I need to make however
the basics are.
1) Changed fieldlength of Employees.UserPass to VARCHAR
(32) to allow the storage
of md5 encrypted passwords. Previous password support
utilised the MySQL
password fuction and field length was insufficient
to store the encrypted
password this resulting in a login failure when
password was changed to a
non-blank string.
2) Modified Employee password encryption to md5 as opposed
to mysql password
encryption. Changes were as follows:
misc.php
134: $sql = "SELECT AccessLevel, Id FROM " .
$emp_db . "Employees WHERE LoginName='" . $login . "' and
UserPass='" . md5($pass) . "' AND Active=1;";
141: $activepass = md5($pass);
employee_admin.php
354: if (strcmp(md5($oldpassword),$activepass)
== 0) {
357: $sql = "UPDATE " . $emp_db . "Employees SET
UserPass='" . md5($password) . "' WHERE " .
$emp_db . "Employees.Id=" . $key . ";";
employee_import.php
194: if ($c == 4) $sql = $sql . "'" . md5(addslashes
($import_data[$r][$c])) . "',";
3) Incorporated changes from bug no: 901079 to fix
gramatical error "New Employee" should be "New Asset"
asset_admin.php
93: if ($insert == true) $insertupdatetext = "New
Asset";