| Index
» Projekty
» phpMyEdit
» Fórum
» md5 |
 |
ezegolub
Založený: 30.12.2003
Príspevky: 1
Zaslal: 2003-12-30 16:18
Návrat hore
Odpovedať s citátom
|
I need to use md5 for passwords, but using a before trigger and changing the value to md5(value) doesnt seem to affect the query that finally gets executed. Is there any way to make it without resorting to using an after trigger that md5s the password with an update ?
Thanks a lot! PME rocks.
Ezequiel
|
hbernard
Založený: 23.03.2003
Príspevky: 159
Bydlisko: FRANCE
Zaslal: 2003-12-30 17:57
Návrat hore
Odpovedať s citátom
|
Hi,
I ran into the same trouble and wasn't successful without using an after trigger (As you said).
Hugues
| ezegolub Napísal: |
I need to use md5 for passwords, but using a before trigger and changing the value to md5(value) doesnt seem to affect the query that finally gets executed. Is there any way to make it without resorting to using an after trigger that md5s the password with an update ?
Thanks a lot! PME rocks.
Ezequiel |
|
ajh
Založený: 17.12.2003
Príspevky: 236
Zaslal: 2003-12-30 20:43
Návrat hore
Odpovedať s citátom
|
If you use the 'sqlw' function in the CVS version of PME, couldn't you just then use the MySQL MD5 function on that field when you write it?
['sqlw'] = 'MD5($val)'
(no promises my syntax is correct ;-)
|
hbernard
Založený: 23.03.2003
Príspevky: 159
Bydlisko: FRANCE
Zaslal: 2003-12-30 22:53
Návrat hore
Odpovedať s citátom
|
hmm, yes, you are totally right.
Just be careful about not applying MD5 against already hashed strings.
You have to use this code
$opts['fdd']['myfield'] = Array(
...
'sqlw' => 'if(myfield=$val_qas,$val_qas,md5($val_qas))',
...
);
in order to avoid re-hashing an already hashed string.
This mean, if 'myfield' value was not changed, then don't apply md5() on it.
If 'myfield' value was changed, then apply md5() on it.
| ajh Napísal: |
If you use the 'sqlw' function in the CVS version of PME, couldn't you just then use the MySQL MD5 function on that field when you write it?
['sqlw'] = 'MD5($val)'
(no promises my syntax is correct ;-) |
|
nepto
Založený: 06.01.2003
Príspevky: 381
Bydlisko: Phoenix, Arizona (USA)
Zaslal: 2004-01-01 22:16
Návrat hore
Odpovedať s citátom
|
Hi guys,
Maybe ['sqlw'] will help, maybe not. I do not know much about MySQL's MD5, thus I cannot recommend you this approach. But it looks flexible. :)
However I came accross this problem about two years ago and have it successfully solved till nowadays.
phpMyEzin: Content Management System
stores user password in MD5 sum formats. This is due to common security issues.
So, how I reach this functionality?
| Kód: |
$ezin_opts['fdd']['password'] = array(
'name'=>'Password',
'select'=>'T',
'maxlen'=>60,
'sort'=>true,
'required'=>true,
'options' => 'APC' .
(ezin_admin_check_full_list_privileges(
$ezin_opts['options']) ? 'VL' : '')
);
|
That was field definition and now class invocation. Please note, these are only relevant parts of whole working code.
| Kód: |
require_once 'phpMyEdit/phpMyEdit.class.php';
$ezin_form_password = phpMyEdit::get_cgi_var('password');
if ($ezin_form_password[0] == '@') {
$ezin_opts['cgi']['overwrite']['password'] =
md5(substr($ezin_form_password, 1));
}
new phpMyEdit($ezin_opts);
$ezin_form_operation = phpMyEdit::get_cgi_var('operation');
if (isset($ezin_form_operation)) {
echo '<hr><small><b>Password</b> - ';
echo 'start with @ character to calculate
MD5 of the rest of string<br></small>';
}
|
The idea behind the implementation is, that password is encrypted only if it starts with '@' character. This prevents before encrypting already encrypted MD5 summary. When user wants to change its password, I simply wrote "@new_password" into input field. After submit, password is updated.
Hope this helps.
_________________
Ondrej Jombik (Nepto)
Visit my
homepage
, review my recent
CV
or
projects
and give me some
feedback
.
|
doug
Založený: 10.02.2003
Príspevky: 1013
Bydlisko: Denver, Colorado (USA)
Zaslal: 2009-08-01 23:08
Návrat hore
Odpovedať s citátom
|
Below is a related encryption example which may help someone.
| Kód: |
$my_secret_salt = 'abc123xyz';
$opts['fdd']['my_encrypted_column'] = array(
'default' => '',
'input' => '',
'name' => 'My Encrypted Column',
'options' => 'ACPVDFL',
'sql' => 'if(my_encrypted_column <> "", AES_DECRYPT(my_encrypted_column, "'.$my_secret_salt.'"), "")',
'sqlw' => 'AES_ENCRYPT(TRIM("$val_as"), "'.$my_secret_salt.'")',
'sort' => false
);
// MySQL tinyblob column |
Using phpMyAdmin, one might add a new column to a table then populate the column with encrypted values from another field, and subsequenly delete the column containing the unencrypted data. BACK UP YOUR DATA BEFORE DOING THIS. NO WARRANTY EXPRESSED OR IMPLIED. Encryption salt for this example is "abc123xyz"
ALTER TABLE `my_table` ADD `my_encrypted_column` TINYBLOB NOT NULL AFTER `id` ;
UPDATE `my_table` SET `my_encrypted_column` = AES_ENCRYPT(`some_other_column`, "abc123xyz");
|
|
Odoslať novú tému
Odpovedať na tému
|
|
|
|
Prihlásiť
Registrácia
English
