zefie/minisrv
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

password updates: fix couldnt password user_id 0, now encrypt instead of hash, backwards compatible

Browse Source
This commit is contained in:
zefie
2026-04-26 17:22:30 -04:00
parent 85a467ea92
commit 575749e970
2 changed files with 15 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
zefie_wtvp_minisrv/includes/ServiceVault/wtv-setup/validate-change-password.js
View File

@@ -19,7 +19,7 @@ if (session_data.user_id !== 0 && session_data.user_id !== parseInt(request_head
data = errpage[1]; data = errpage[1];
} }
if (user_id && !errpage) { if (user_id >= 0 && !errpage) {
headers = `200 OK headers = `200 OK
Connection: Keep-Alive Connection: Keep-Alive
Content-Type: text/html` Content-Type: text/html`

16
zefie_wtvp_minisrv/includes/classes/WTVClientSessionData.js
View File

@@ -692,10 +692,16 @@ class WTVClientSessionData {
return CryptoJS.AES.decrypt(crypt, this.cryptoKey).toString(CryptoJS.enc.Utf8); return CryptoJS.AES.decrypt(crypt, this.cryptoKey).toString(CryptoJS.enc.Utf8);
} }
encodePassword(passwd) {
oldDecodePassword(passwd) {
return CryptoJS.SHA512(passwd).toString(CryptoJS.enc.Base64); return CryptoJS.SHA512(passwd).toString(CryptoJS.enc.Base64);
} }
encodePassword(passwd) {
//return CryptoJS.SHA512(passwd).toString(CryptoJS.enc.Base64);
return this.encryptPassword(passwd);
}
setUserPassword(passwd) { setUserPassword(passwd) {
this.setSessionData("subscriber_password", this.encodePassword(passwd)); this.setSessionData("subscriber_password", this.encodePassword(passwd));
this.saveSessionData(); this.saveSessionData();
@@ -723,7 +729,13 @@ class WTVClientSessionData {
validateUserPassword(passwd) { validateUserPassword(passwd) {
if (!this.getUserPasswordEnabled()) return true; // no password is set so always validate if (!this.getUserPasswordEnabled()) return true; // no password is set so always validate
return (this.encodePassword(passwd) === this.getSessionData("subscriber_password")); if (passwd === this.decryptPassword(this.getSessionData("subscriber_password"))) return true; // check against current encryption
else if (this.oldDecodePassword(passwd) === this.getSessionData("subscriber_password")) {
// if password matches old hash, update to new encryption
this.setUserPassword(passwd);
return true;
}
return false;
} }
isUserLoggedIn() { isUserLoggedIn() {