Project

General

Profile

Actions

Feature #20774

closed

Change Hardcoded MD5 Password Encryption in User/Setup

Added by Steffen Ritter over 15 years ago. Updated over 14 years ago.

Status:
Closed
Priority:
Should have
Category:
-
Target version:
-
Start date:
2009-07-21
Due date:
% Done:

0%

Estimated time:
PHP Version:
5.1
Tags:
Complexity:
Sprint Focus:

Description

Currently it is only possible to change your BE-Password via User->Setup to an md5 hash.
For saltedpasswords integration this must be flexible

Solution:
Introduce an Hook zu register your own eval-Func.

thanks to Steffen Kamper who provided the patch, saltedpasswords is using
(issue imported from #M11564)


Files

setup_beuserpw_eval.diff (1.9 KB) setup_beuserpw_eval.diff Administrator Admin, 2009-07-21 10:53
11564_saltedpwhook_v2.diff (2.17 KB) 11564_saltedpwhook_v2.diff Administrator Admin, 2009-09-17 09:55
11564_ext_saltedpw.diff (1.29 KB) 11564_ext_saltedpw.diff Administrator Admin, 2009-09-17 10:03
11564_saltedpwhook_v3.diff (2.4 KB) 11564_saltedpwhook_v3.diff Administrator Admin, 2009-09-17 21:19

Related issues 1 (0 open1 closed)

Related to TYPO3 Core - Bug #19677: Hardcoded md5-ization of be user password in sysext/setup/mod/index.phpClosedRupert Germann2008-12-04

Actions
Actions #1

Updated by Rupert Germann about 15 years ago

I added a new patch which works with latest "saltedpasswords" from forge:
http://forge.typo3.org/repositories/browse/extension-t3sec_saltedpw/trunk

Attention: this patch also requires changes in "saltedpasswords": see patch 11564_ext_saltedpw.diff

Actions #2

Updated by Rupert Germann about 15 years ago

Question:
why do we have 2 salted passwords extensions?
is t3sec_saltedpw from TER supposed to work with 4.3, too ?

Actions #3

Updated by Steffen Ritter about 15 years ago

hi Rupert,
t3sec_saltedpw will get <4.3...
saltedpasswords in trunk is the sys-ext implementation which was nearly build from scratch.

Will apply your patch and commit it to saltedpasswords trunk!

Actions #4

Updated by Rupert Germann about 15 years ago

how to test:
- check out latest "saltedpasswords" from svn
- install it and configure it to be used for be_user passwords
- apply the patch 11564_ext_saltedpw.diff to "saltedpasswords"
- apply the patch 11564_saltedpwhook_v2.diff to TYPO3 trunk
- open the setup module and change your password
- log out
- log in with your new password

Actions #5

Updated by Steffen Ritter about 15 years ago

saltedpassword changes committed,

so you can skip patching saltedpasswords

Actions #6

Updated by Marcus Krause about 15 years ago

Thanks a lot, Steffen!

Again for clarification:
  • t3sec_saltedpw is a extension in TER to be used with TYPO3 < 4.3
    (considered to be as proof of concept althought it is already widely deployed)
  • saltedpasswords will be a sysext for TYPO3 4.3
    (backwards compatible with t3sec_saltedpw; provides further hashing methods)

Regarding Forge: sysext is in trunk, TER ext is in branch RB-TER

Actions #7

Updated by Rupert Germann about 15 years ago

thanks steffen.
did it work for you?

Actions #8

Updated by Steffen Ritter about 15 years ago

shure, works for me!

so +1 :)

Actions #9

Updated by Rupert Germann about 15 years ago

committed attached v3 to trunk rev 5957

Actions

Also available in: Atom PDF