[PATCH] proxy.cgi: Switch to MD5 hashed passwords for local user auth.

[PATCH] proxy.cgi: Switch to MD5 hashed passwords for local user auth.

[Stefan Schantl]

[-- Attachment #1: Type: text/plain, Size: 780 bytes --]

The former used default Crypt algorithmus only supports passwords up to
eight signs wheater MD5 does not have any limitation here.

Fixes 12290.

Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
---
 html/cgi-bin/proxy.cgi | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/html/cgi-bin/proxy.cgi b/html/cgi-bin/proxy.cgi
index b63964081..06aca579b 100644
--- a/html/cgi-bin/proxy.cgi
+++ b/html/cgi-bin/proxy.cgi
@@ -3945,7 +3945,13 @@ sub adduser
 	} else {
 		&deluser($str_user);
 
-		my $htpasswd = new Apache::Htpasswd("$userdb");
+		my %htpasswd_options = (
+			passwdFile => "$userdb",
+			UseMD5 => 1,
+		);
+
+		my $htpasswd = new Apache::Htpasswd(\%htpasswd_options);
+
 		$htpasswd->htpasswd($str_user, $str_pass);
 	}
 
-- 
2.25.0

Re: [PATCH] proxy.cgi: Switch to MD5 hashed passwords for local user auth.

[Michael Tremer]

[-- Attachment #1: Type: text/plain, Size: 1182 bytes --]

Ah yes, it is great to finally deploy MD5 in 2020.

Luckily this doesn’t matter because the passwords are being sent in plain text over an unencrypted channel.

Reviewed-by: Michael Tremer <michael.tremer(a)ipfire.org>

> On 7 Feb 2020, at 11:06, Stefan Schantl <stefan.schantl(a)ipfire.org> wrote:
> 
> The former used default Crypt algorithmus only supports passwords up to
> eight signs wheater MD5 does not have any limitation here.
> 
> Fixes 12290.
> 
> Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
> ---
> html/cgi-bin/proxy.cgi | 8 +++++++-
> 1 file changed, 7 insertions(+), 1 deletion(-)
> 
> diff --git a/html/cgi-bin/proxy.cgi b/html/cgi-bin/proxy.cgi
> index b63964081..06aca579b 100644
> --- a/html/cgi-bin/proxy.cgi
> +++ b/html/cgi-bin/proxy.cgi
> @@ -3945,7 +3945,13 @@ sub adduser
> 	} else {
> 		&deluser($str_user);
> 
> -		my $htpasswd = new Apache::Htpasswd("$userdb");
> +		my %htpasswd_options = (
> +			passwdFile => "$userdb",
> +			UseMD5 => 1,
> +		);
> +
> +		my $htpasswd = new Apache::Htpasswd(\%htpasswd_options);
> +
> 		$htpasswd->htpasswd($str_user, $str_pass);
> 	}
> 
> -- 
> 2.25.0
>