Error authenticating users

Jose Manuel Molina — Mon, 06 Sep 2004 16:17:13 -0000

After installing, when I try to authentuicate as root a
bad password response is returned.

I put the password fielto to blank in the Database and
authenticating with no password worked, I created one
user and tried to login with it, It also failed.

I wandered through the code and found some things whose
pourpouse I dont fully understand.

In the install script the sequence with the root
password is:

$password = "calendar";
$password = $security->encryption($password);
$password = base64_encode($password);

ok, you end up with a encrypted and base64 encoded
password.

then, at the login.php script the code is:

$db_password = $query_data->password;
$db_password = $security->decryption($db_password);
if($password == $db_password) .............

I think it should b better to do (in fact, I have
modified the script and this works fine):
$db_password = $query_data->password;
$password = $security->encryption($password);
$password = base64_encode($password);
if($password == $db_password) .............

I haven't studied the code in this script, but..... you
perform this same thing in two places, I think you
could manage to perfomr this in only one place,
rethinking the ifs should be enough.

One thing more, is that, the encryption you perform is
not a one way encription(althoug as you have seen the
way you perform authentication doesn't work for me), If
I get the encrypted value in the DB, I can get the
password simply by passing that value to a php script.

If you used a one way encryption solution, a brute
force attack would be necesary as you cannot retrieve
the password form the encrypted form, and so, the
proccess to authenticate is the one I put instead of yours.

I'm using

Windows 2000 Prof, adv sever, and XP home (same
behaviour in all of them)

Postgresql 8 beta

Php 4.3.5

Thanks.

Short Page header still has BCS initials

CoryJ — Wed, 08 Oct 2003 21:02:19 -0000

On some pages, v1.1-r3 uses BCS for school initials
instead of user-configured initials.

Recent changes to bugs

Error authenticating users

Short Page header still has BCS initials