cvs: php-master-web /include cvs-auth.inc

bjori Wed Dec 17 12:52:44 2008 UTC Modified files: /php-master-web/include cvs-auth.inc Log: Autmatically generate svn passwords on login (meaning: people dont have to "change" their passwords anymore to get access to svn) http://cvs.php.net/viewvc.cgi/php-master-web/include/cvs-auth.inc?r1=1.4&r2=1.5&diff_format=u Index: php-master-web/include/cvs-auth.inc diff -u php-master-web/include/cvs-auth.inc:1.4 php-master-web/include/cvs-auth.inc:1.5 --- php-master-web/include/cvs-auth.inc:1.4 Sat Mar 1 16:46:38 2008 +++ php-master-web/include/cvs-auth.inc Wed Dec 17 12:52:43 2008 @@ -1,8 +1,9 @@ -<?php -/* $Id: cvs-auth.inc,v 1.4 2008/03/01 16:46:38 bjori Exp $ */ +<?php // vim: et ts=4 sw=4 +/* $Id: cvs-auth.inc,v 1.5 2008/12/17 12:52:43 bjori Exp $ */ define("LOGIN_IGNORE_PWD", FALSE); define("LOGIN_PWD_FILE", "/repository/CVSROOT/passwd"); +require dirname(__FILE__) . "/svn-auth.inc"; function find_password($user) { @@ -25,7 +26,32 @@ function verify_password($user, $pass) { - return verify_login(find_password($user), $pass); + if (!LOGIN_IGNORE_PWD) { + @mysql_connect("localhost","nobody","") + or die("unable to connect to database"); + @mysql_select_db("phpmasterdb"); + + $username = escape($user); + $res = @mysql_query("SELECT md5passwd FROM users WHERE svnpasswd != '' AND md5passwd != '' AND cvsaccess AND username = '$username'"); + + // There is a good chance that md5passwd is empty + if ($res && mysql_num_rows($res) == 1) { + $row = @mysql_fetch_array($res); + return md5($pass) == $row["md5passwd"]; + } + } + if (verify_login(find_password($user), $pass)) { + if (!LOGIN_IGNORE_PWD) { + // Update the password to enable svn access + $svnpasswd = gen_svn_pass($user, $pass); + $md5passwd = md5($pass); + + $query = "UPDATE users SET svnpasswd='$svnpasswd', md5passwd='$md5passwd' WHERE username='$username'"; + mysql_query($query); + } + return TRUE; + } + return FALSE; } function verify_login($psw, $pass)