Prefixed SHA256 password hashes

This way we can identify them and still compare to legacy MD5 hashes

diff --git a/f.php b/f.php
index f0a3d12d5b5b2347c6af3473ccebb43560a7954f..25f6be36a174cb293f2b73f61e506a3cc8a44919 100644 (file)
--- a/f.php
+++ b/f.php
@@ -171,7 +171,10 @@ if (!empty($link['key'])) {
         require(JIRAFEAU_ROOT.'lib/template/footer.php');
         exit;
     } else {
         require(JIRAFEAU_ROOT.'lib/template/footer.php');
         exit;
     } else {

-        if (hash_equals($link['key'], hash('sha256', $_POST['key']))) {
+        if (strpos($link['key'], '[SHA256]') == 0 && hash_equals(substr($link['key'], 8), hash('sha256', $_POST['key']))) {
+            $password_challenged = true;
+        }
+        elseif (hash_equals($link['key'], md5($_POST['key']))) {

             $password_challenged = true;
         } else {
             sleep(2);
             $password_challenged = true;
         } else {
             sleep(2);

diff --git a/lib/functions.php b/lib/functions.php
index bb0d2515e0f4bc6649d9992bef54088971093c62..9ea7351bcc444e3fa043510a2d48f448fa188693 100644 (file)
--- a/lib/functions.php
+++ b/lib/functions.php
@@ -544,7 +544,7 @@ function jirafeau_add_file($file, $one_time_download, $key, $time, $ip, $crypt,
     /* hash password or empty. */
     $password = '';
     if (!empty($key)) {
     /* hash password or empty. */
     $password = '';
     if (!empty($key)) {

-        $password = hash('sha256', $key);
+        $password = '[SHA256]'.hash('sha256', $key);

     }
 
     /* create link file */
     }
 
     /* create link file */


@@ -1091,7 +1091,7 @@ function jirafeau_async_init($filename, $type, $one_time, $key, $time, $ip)
     /* sha256 password or empty */
     $password = '';
     if (!empty($key)) {
     /* sha256 password or empty */
     $password = '';
     if (!empty($key)) {

-        $password = hash('sha256', $key);
+        $password = '[SHA256]'.hash('sha256', $key);

     }
 
     /* Store information. */
     }
 
     /* Store information. */