From 927ea90d2d0b16b510fc9dad618ccb9ac374c4cd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Isma=C3=ABl=20Bouya?= Date: Sun, 7 Jul 2024 02:36:38 +0200 Subject: Fix ldap passwords --- systems/eldiron/base.nix | 2 +- systems/eldiron/websites/tools/landing/ldap_password.php | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) (limited to 'systems/eldiron') diff --git a/systems/eldiron/base.nix b/systems/eldiron/base.nix index fa5e504..4535dcf 100644 --- a/systems/eldiron/base.nix +++ b/systems/eldiron/base.nix @@ -189,7 +189,7 @@ table = ldap_users user_column = login pw_type = function - auth_query = SELECT ((mechanism = 'SSHA' AND password = encode(digest( %p || salt, 'sha1'), 'hex')) OR (mechanism = 'PLAIN' AND password = %p)) FROM ldap_users WHERE login = %u OR login || '@' || realm = %u + auth_query = SELECT ((mechanism = 'SSHA' AND password = encode(digest( convert_to(%p, 'UTF8') || salt, 'sha1'), 'hex')) OR (mechanism = 'PLAIN' AND password = %p)) FROM ldap_users WHERE login = %u OR login || '@' || realm = %u #pwd_query = WITH newsalt as (select gen_random_bytes(4)) UPDATE ldap_users SET password = encode(digest( %p || (SELECT * FROM newsalt), 'sha1'), 'hex'), salt = (SELECT * FROM newsalt), mechanism = 'SSHA' WHERE login = %u OR login || '@' || realm = %u ''; }; diff --git a/systems/eldiron/websites/tools/landing/ldap_password.php b/systems/eldiron/websites/tools/landing/ldap_password.php index efb4f57..b3b2f15 100644 --- a/systems/eldiron/websites/tools/landing/ldap_password.php +++ b/systems/eldiron/websites/tools/landing/ldap_password.php @@ -45,7 +45,7 @@ function changePasswordSQL($user_realm, $newPassword) { } } $con = pg_connect(""); - $result = pg_query_params($con, "WITH newsalt as (SELECT gen_random_bytes(4)) UPDATE ldap_users SET password = encode(digest( $1 || (SELECT * FROM newsalt), 'sha1'), 'hex'), mechanism = 'SSHA', salt = (SELECT * FROM newsalt) where login || '@' || realm = $2", array($newPassword, $user_realm)); + $result = pg_query_params($con, "WITH newsalt as (SELECT gen_random_bytes(4)) UPDATE ldap_users SET password = encode(digest( convert_to($1, 'UTF8') || (SELECT * FROM newsalt), 'sha1'), 'hex'), mechanism = 'SSHA', salt = (SELECT * FROM newsalt) where login || '@' || realm = $2", array($newPassword, $user_realm)); if (!$result) { $message[] = "Error when accessing database"; return false; -- cgit v1.2.3