|
|
@@ -4,7 +4,7 @@ include_once ("hash_tool.php");
|
|
|
/**
|
|
|
* htpasswd tools for Apache Basic Auth.
|
|
|
*
|
|
|
- * Uses crypt only!
|
|
|
+ * now uses crypt_apr1_md5
|
|
|
*/
|
|
|
class htpasswd {
|
|
|
var $fp;
|
|
|
@@ -29,7 +29,7 @@ class htpasswd {
|
|
|
fwrite ( $bdfp, $htaccess_content );
|
|
|
}
|
|
|
|
|
|
- @$this->fp = @$this::open_or_create ( $htpasswdfile );
|
|
|
+ @$this->fp = @$this::open_or_create ( $htpasswdfile ) or die('Cannot open file for R/W: '.$htpasswdfile);
|
|
|
|
|
|
if ($use_metadata) {
|
|
|
$htmetafile = $path . "/" . self::HTMETA_NAME;
|
|
|
@@ -94,7 +94,11 @@ class htpasswd {
|
|
|
if ($this->user_exists ( $username ))
|
|
|
return false;
|
|
|
fseek ( $this->fp, 0, SEEK_END );
|
|
|
- fwrite ( $this->fp, $username . ':' . self::htcrypt ( $password ) . "\n" );
|
|
|
+ //fwrite ( $this->fp, $username . ':' . self::htcrypt ( $password ) . "\n" );
|
|
|
+ fwrite ( $this->fp, $username . ':' . self::crypt_apr1_md5 ( $password ) . "\n" );
|
|
|
+ // quick and dirty 1. solution to add crypt_apr1_md5 encrypted passwords using htpasswd program
|
|
|
+ // echo "htpasswd -bm \"$this->filename\" \"$username\" \"$password\"";
|
|
|
+ // exec("htpasswd -bm \"$this->filename\" \"$username\" \"$password\"");
|
|
|
return true;
|
|
|
}
|
|
|
function meta_add(meta_model $meta_model) {
|
|
|
@@ -139,11 +143,30 @@ class htpasswd {
|
|
|
rewind ( $this->fp );
|
|
|
while ( ! feof ( $this->fp ) && trim ( $lusername = array_shift ( explode ( ":", $line = rtrim ( fgets ( $this->fp ) ) ) ) ) ) {
|
|
|
if ($lusername == $username) {
|
|
|
- fseek ( $this->fp, (- 15 - strlen ( $username )), SEEK_CUR );
|
|
|
- fwrite ( $this->fp, $username . ':' . self::htcrypt ( $password ) . "\n" );
|
|
|
+ //fseek ( $this->fp, (- 15 - strlen ( $username )), SEEK_CUR );
|
|
|
+ //fwrite ( $this->fp, $username . ':' . self::htcrypt ( $password ) . "\n" );
|
|
|
+ fseek ( $this->fp, (- 39 - strlen ( $username )), SEEK_CUR );
|
|
|
+ fwrite ( $this->fp, $username . ':' . self::crypt_apr1_md5 ( $password ) . "\n" );
|
|
|
return true;
|
|
|
}
|
|
|
}
|
|
|
+ rewind ( $this->fp );
|
|
|
+ while ( ! feof ( $this->fp ) && trim ( $lusername = array_shift ( explode ( ":", $line = rtrim ( fgets ( $this->fp ) ) ) ) ) ) {
|
|
|
+ if ($lusername == $username) {
|
|
|
+ //exec("htpasswd -bm \"$this->filename\" \"$username\" \"$password\"");
|
|
|
+ if ($use_metadata) {
|
|
|
+ $meta_model = new meta_model ();
|
|
|
+ $meta_model->user = $username;
|
|
|
+ $meta_model->email = $_POST ['email'];
|
|
|
+ $meta_model->name = $_POST ['name'];
|
|
|
+ $meta_model->mailkey = random_password(16);
|
|
|
+ }
|
|
|
+ return true;
|
|
|
+ }
|
|
|
+ }
|
|
|
+ // quick and dirty 1. solution to add crypt_apr1_md5 encrypted passwords using htpasswd program
|
|
|
+ //echo "htpasswd -bm \"$this->filename\" \"$username\" \"$password\"";
|
|
|
+ //exec("htpasswd -bm \"$this->filename\" \"$username\" \"$password\"");
|
|
|
return false;
|
|
|
}
|
|
|
function meta_update(meta_model $meta_model) {
|
|
|
@@ -187,6 +210,39 @@ class htpasswd {
|
|
|
static function htcrypt($password) {
|
|
|
return crypt ( $password, substr ( str_replace ( '+', '.', base64_encode ( pack ( 'N4', mt_rand (), mt_rand (), mt_rand (), mt_rand () ) ) ), 0, 22 ) );
|
|
|
}
|
|
|
+ static function crypt_apr1_md5($plainpasswd)
|
|
|
+ {
|
|
|
+ // htpassword function for Apache > 2.2.18, Nginx
|
|
|
+ // https://www.virendrachandak.com/techtalk/using-php-create-passwords-for-htpasswd-file/
|
|
|
+ // https://stackoverflow.com/questions/2994637/how-to-edit-htpasswd-using-php/8786956#8786956
|
|
|
+ $salt = substr(str_shuffle("abcdefghijklmnopqrstuvwxyz0123456789"), 0, 8);
|
|
|
+ $len = strlen($plainpasswd);
|
|
|
+ $text = $plainpasswd.'$apr1$'.$salt;
|
|
|
+ $bin = pack("H32", md5($plainpasswd.$salt.$plainpasswd));
|
|
|
+ for($i = $len; $i > 0; $i -= 16) { $text .= substr($bin, 0, min(16, $i)); }
|
|
|
+ for($i = $len; $i > 0; $i >>= 1) { $text .= ($i & 1) ? chr(0) : $plainpasswd{0}; }
|
|
|
+ $bin = pack("H32", md5($text));
|
|
|
+ for($i = 0; $i < 1000; $i++)
|
|
|
+ {
|
|
|
+ $new = ($i & 1) ? $plainpasswd : $bin;
|
|
|
+ if ($i % 3) $new .= $salt;
|
|
|
+ if ($i % 7) $new .= $plainpasswd;
|
|
|
+ $new .= ($i & 1) ? $bin : $plainpasswd;
|
|
|
+ $bin = pack("H32", md5($new));
|
|
|
+ }
|
|
|
+ for ($i = 0; $i < 5; $i++)
|
|
|
+ {
|
|
|
+ $k = $i + 6;
|
|
|
+ $j = $i + 12;
|
|
|
+ if ($j == 16) $j = 5;
|
|
|
+ $tmp = $bin[$i].$bin[$k].$bin[$j].$tmp;
|
|
|
+ }
|
|
|
+ $tmp = chr(0).chr(0).$bin[11].$tmp;
|
|
|
+ $tmp = strtr(strrev(substr(base64_encode($tmp), 2)),
|
|
|
+ "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/",
|
|
|
+ "./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz");
|
|
|
+ return "$"."apr1"."$".$salt."$".$tmp;
|
|
|
+ }
|
|
|
|
|
|
|
|
|
static function create_hash_tool($hash) {
|
