TYPO3 Core

'loginSecurityLevel' => '', // String. Keywords that determines the security level of login to the backend. "normal" means the password from the login form is sent in clear-text, "challenged" means the password is not sent but hashed with some other values, "superchallenged" (default) means the password is first hashed before being hashed with the challenge values again (means the password is stored as a hashed string in the database also). DO NOT CHANGE this value manually; without an alternative authentication service it will only prevent logins in TYPO3 since the "superchallenged" method is hardcoded in the default authentication system.

'loginSecurityLevel' => '', // See description for TYPO3_CONF_VARS[BE][loginSecurityLevel]. Default state for frontend is "normal". Alternative authentication services can implement higher levels if preferred.

var $security_level = 'superchallenged'; // sets the level of security. *'normal' = clear-text. 'challenged' = hashed password/username from form in $formfield_uident. 'superchallenged' = hashed password hashed again with username.

$this->security_level = $this->security_level ? $this->security_level : 'normal';

// Create a random challenge string

$challenge = $this->getChallenge();

// Save challenge value in session data (thanks to Bernhard Kraft for providing code):

session_start();

$_SESSION['login_challenge'] = $challenge;

$this->content.= $this->getHiddenFields($challenge);

if (!$_COOKIE[$BE_USER->name]) {

if ($redirectToURL = (string)$BE_USER->getTSConfigVal('auth.BE.redirectToURL')) {

}

if ($this->loginSecurityLevel == 'challenged') {

$output.= '

<form action="index.php" method="post" name="loginform" onsubmit="doChallengeResponse(0);">

';

} elseif ($this->loginSecurityLevel == 'normal') {

$output.= '

<form action="index.php" method="post" name="loginform" onsubmit="document.loginform.userident.value=document.loginform.p_field.value;document.loginform.p_field.value=\'\';return true;">

';

} else { // if ($this->loginSecurityLevel == 'superchallenged') {

$output.= '

<form action="index.php" method="post" name="loginform" onsubmit="doChallengeResponse(1);">

';

$output.= '

<input type="hidden" name="login_status" value="login" />

';

* Output some hidden fields at the end of the login form

* @param string The challenge string to be included in the output

function getHiddenFields($challenge) {

$output = '

<input type="hidden" name="userident" value="" />

<input type="hidden" name="challenge" value="'.$challenge.'" />

<input type="hidden" name="redirect_url" value="'.htmlspecialchars($this->redirectToURL).'" />

<input type="hidden" name="loginRefresh" value="'.htmlspecialchars($this->loginRefresh).'" />

'.$this->interfaceSelector_hidden.'

'.$this->addFields_hidden.'

';

return $output;

* Set JavaScript for creating a MD5 hash of the password

global $TBE_TEMPLATE;

$JScode = '

<script type="text/javascript" src="md5.js"></script>

'.$TBE_TEMPLATE->wrapScriptTags('

function doChallengeResponse(superchallenged) { //

password = document.loginform.p_field.value;

if (password) {

if (superchallenged) {

password = MD5(password); // this makes it superchallenged!!

}

str = document.loginform.username.value+":"+password+":"+document.loginform.challenge.value;

document.loginform.userident.value = MD5(str);

document.loginform.p_field.value = "";

return true;

}

function startUp() {

// If the login screen is shown in the login_frameset window for re-login, then try to get the username of the current/former login from opening windows main frame:

if (parent.opener && parent.opener.TS && parent.opener.TS.username && document.loginform && document.loginform.username) {

document.loginform.username.value = parent.opener.TS.username;

}

// Wait a few millisecons before calling checkFocus(). This might be necessary because some browsers need some time to auto-fill in the form fields

window.setTimeout("checkFocus()", 50);

// This moves focus to the right input field:

function checkFocus() {

// If for some reason there already is a username in the username form field, move focus to the password field:

if (document.loginform.username && document.loginform.username.value == "") {

document.loginform.username.focus();

} else if (document.loginform.p_field && document.loginform.p_field.type!="hidden") {

document.loginform.p_field.focus();

}

}

return $JScode;

/**

* Create a random challenge string

*

* @return string Challenge value

*/

function getChallenge() {

$challenge = md5(uniqid('').getmypid());

return $challenge;

}