Replace password hash check with password_verify
This commit is contained in:
@@ -13,7 +13,7 @@ if (str_starts_with($ua, "SysAdminAuth/")) {
|
||||
header("HTTP/1.1 403 Forbidden");
|
||||
die();
|
||||
}
|
||||
if ($userdata["password"] !== hash("sha256", $userpass)) {
|
||||
if (password_verify($userpass, $userdata["password"])) {
|
||||
header("HTTP/1.1 403 Forbidden");
|
||||
die();
|
||||
}
|
||||
@@ -32,4 +32,4 @@ if (!$_SESSION["auth_ok"]) {
|
||||
if (!in_array("$APP_CODE:access", $_SESSION["auth_data"]["permissions"])) {
|
||||
header("Location: /index.php?_resultcolor=red&_result=" . urlencode("No tienes permisos para acceder a $APP_NAME."));
|
||||
die();
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user