From b22be5427fbc98710e0dba0e7d2508ef936a6b51 Mon Sep 17 00:00:00 2001 From: Nikolai Kristiansen Date: Wed, 5 Aug 2015 15:51:32 +0200 Subject: [PATCH] Removes legacy MySQL password support --- inside/ldap.php | 3 +-- vaktliste/App/Mapper/UserMapper.php | 4 ++-- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/inside/ldap.php b/inside/ldap.php index 42b7ed4..36f7c99 100644 --- a/inside/ldap.php +++ b/inside/ldap.php @@ -115,9 +115,8 @@ function legacy_get_user_from_mail($mail) { function legacy_authenticate($username, $password) { $conn = db_connect(); /* query db with form data (password, username) */ - $sql = sprintf("SELECT id FROM din_user WHERE username = %s AND (password = PASSWORD(%s) or password = OLD_PASSWORD(%s))", + $sql = sprintf("SELECT id FROM din_user WHERE username = %s AND password = PASSWORD(%s)", $conn->quoteSmart($username), - $conn->quoteSmart($password), $conn->quoteSmart($password)); $result = $conn->query($sql); diff --git a/vaktliste/App/Mapper/UserMapper.php b/vaktliste/App/Mapper/UserMapper.php index 3f9f6cf..e07ee14 100644 --- a/vaktliste/App/Mapper/UserMapper.php +++ b/vaktliste/App/Mapper/UserMapper.php @@ -38,7 +38,7 @@ class App_Mapper_UserMapper extends App_Mapper_Mapper { //$this->deleteStmt = self::$PDO->prepare( // "DELETE FROM din_user WHERE id=?"); $this->findByLoginStmt = self::$PDO->prepare( - "SELECT * FROM din_user WHERE username=? AND ( password=PASSWORD(?) or password=OLD_PASSWORD(?) )"); + "SELECT * FROM din_user WHERE username=? AND password=PASSWORD(?)"); } protected function doCreateObject(array $array) { @@ -123,4 +123,4 @@ class App_Mapper_UserMapper extends App_Mapper_Mapper { } } -?> \ No newline at end of file +?>