fernando/luos
1
0
Fork 0
Code Releases Activity

HOR-3433

Browse Source 
Fix ProcessMaker User Password Hash Disclosure.
This commit is contained in:
davidcallizaya
2017-08-09 14:40:02 -04:00
parent b839a247d9
commit 2f3daccd6b
5 changed files with 43 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
workflow/engine/src/ProcessMaker/BusinessModel/User.php
View File

@@ -785,7 +785,7 @@ class User
$oUser = new Users();
$aUser = $oUser->load($userUid);
$oUserProperty = new UsersProperties();
$aUserProperty = $oUserProperty->loadOrCreateIfNotExists($userUid, array("USR_PASSWORD_HISTORY" => serialize(array($aUser["USR_PASSWORD"]))));
$aUserProperty = $oUserProperty->loadOrCreateIfNotExists($userUid, array("USR_PASSWORD_HISTORY" => serialize(array($oUser->getUsrPassword()))));
$aUserProperty["USR_LOGGED_NEXT_TIME"] = $arrayData["USR_LOGGED_NEXT_TIME"];
$oUserProperty->update($aUserProperty);
}

2
workflow/engine/src/ProcessMaker/BusinessModel/WebEntry.php
View File

@@ -382,7 +382,7 @@ class WebEntry
$arrayUserData = $user->load($arrayWebEntryData["USR_UID"]);
$usrUsername = $arrayUserData["USR_USERNAME"];
$usrPassword = $arrayUserData["USR_PASSWORD"];
$usrPassword = $user->getUsrPassword();
$dynaForm = new \Dynaform();