fernando/luos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

PMCORE-2298 Password is stored in plain text when is hashed via G::encrypt and it contains a pipe (|)

Browse Source
This commit is contained in:
Roly Rudy Gutierrez Pinto
2021-02-04 18:07:47 -04:00
parent f5d434ffdf
commit 4711d6687d
10 changed files with 81 additions and 65 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
workflow/engine/src/ProcessMaker/BusinessModel/DataBaseConnection.php
View File

@@ -198,9 +198,9 @@ class DataBaseConnection
$dataDBConnection['DBS_PASSWORD'] = '';
} else {
if ($flagTns == 0) {
$pass = G::encrypt( $dataDBConnection["DBS_PASSWORD"], $dataDBConnection["DBS_DATABASE_NAME"]) . "_2NnV3ujj3w";
$pass = G::encrypt( $dataDBConnection["DBS_PASSWORD"], $dataDBConnection["DBS_DATABASE_NAME"], false, false) . "_2NnV3ujj3w";
} else {
$pass = G::encrypt($dataDBConnection["DBS_PASSWORD"], $dataDBConnection["DBS_TNS"]) . "_2NnV3ujj3w";
$pass = G::encrypt($dataDBConnection["DBS_PASSWORD"], $dataDBConnection["DBS_TNS"], false, false) . "_2NnV3ujj3w";
}
$dataDBConnection['DBS_PASSWORD'] = $pass;