0ct0pu5/wesnoth
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Re-add html character escaping.

Browse source
This commit is contained in:
Pentarctagon 2021-11-05 13:45:53 -05:00
parent 8304ada17c
commit 54482b133c
No known key found for this signature in database
GPG key ID: 9456BC54A21DBFA0
1 changed files with 21 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
src/server/common/server_base.cpp
View file

@ -595,13 +595,32 @@ std::string server_base::hash_password(const std::string& pw, const std::string&
return "";
}
std::string password = pw;
// Apparently HTML key-characters are passed to the hashing functions of phpbb in this escaped form.
// I will do closer investigations on this, for now let's just hope these are all of them.
// Note: we must obviously replace '&' first, I wasted some time before I figured that out... :)
for(std::string::size_type pos = 0; (pos = password.find('&', pos)) != std::string::npos; ++pos) {
password.replace(pos, 1, "&");
}
for(std::string::size_type pos = 0; (pos = password.find('\"', pos)) != std::string::npos; ++pos) {
password.replace(pos, 1, """);
}
for(std::string::size_type pos = 0; (pos = password.find('<', pos)) != std::string::npos; ++pos) {
password.replace(pos, 1, "&lt;");
}
for(std::string::size_type pos = 0; (pos = password.find('>', pos)) != std::string::npos; ++pos) {
password.replace(pos, 1, "&gt;");
}
if(utils::md5::is_valid_prefix(salt)) {
std::string hash = utils::md5(pw, utils::md5::get_salt(salt), utils::md5::get_iteration_count(salt)).base64_digest();
std::string hash = utils::md5(password, utils::md5::get_salt(salt), utils::md5::get_iteration_count(salt)).base64_digest();
return salt+hash;
} else if(utils::bcrypt::is_valid_prefix(salt)) {
try {
auto bcrypt_salt = utils::bcrypt::from_salted_salt(salt);
auto hash = utils::bcrypt::hash_pw(pw, bcrypt_salt);
auto hash = utils::bcrypt::hash_pw(password, bcrypt_salt);
return hash.base64_digest();
} catch(const utils::hash_error& err) {
ERR_SERVER << "bcrypt hash failed for user " << username << ": " << err.what() << std::endl;