proxmox-mirrors/pve-access-control
1
0
Fork 0
mirror of https://git.proxmox.com/git/pve-access-control synced 2025-08-14 23:32:28 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

encrypt_pw: avoid '+' for crypt salt

Browse Source 
And make salt less predictable.
This commit is contained in:
Dietmar Maurer 2017-03-30 08:53:12 +02:00
parent 0835385bea
commit 54028297ea
1 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
PVE/Auth/Plugin.pm
View File

@ -130,11 +130,18 @@ sub parse_tfa_config {
return $res; return $res;
} }
my $salt_starter = time();
sub encrypt_pw { sub encrypt_pw {
my ($pw) = @_; my ($pw) = @_;
my $time = substr(Digest::SHA::sha1_base64 (time), 0, 8); $salt_starter++;
return crypt(encode("utf8", $pw), "\$5\$$time\$"); my $salt = substr(Digest::SHA::sha1_base64(time() + $salt_starter + $$), 0, 8);
# crypt does not want '+' in salt (see 'man crypt')
$salt =~ s/\+/X/g;
return crypt(encode("utf8", $pw), "\$5\$$salt\$");
} }
my $defaultData = { my $defaultData = {