How to compare passwords in TXP?

skrishi · 2011-03-22 19:27:56

Gocom wrote:

Dev branch uses phpass as of today.

Sorry, I do not understand your answer = (
Can you read more?
I did not speak English at an appropriate level.

net-carver · 2011-03-22 21:52:58

skrishi wrote:

Sorry, I do not understand your answer = (
Can you read more?

It means that TXP now has a robust hashing scheme that is actually well matched to the job of storing password hashes.

You can read more at http://www.openwall.com/phpass/

skrishi · 2011-03-22 21:59:35

net-carver wrote:

It means that TXP now has a robust hashing scheme that is actually well matched to the job of storing password hashes.
You can read more at http://www.openwall.com/phpass/

So now there is hashing the password does not depend on the version of mysql?

net-carver · 2011-03-22 22:02:23

From the next released version of TXP, or from any version of TXP you now pull from SVN, yes.

Edited to add: That’s only one of the advantages of using PHPass, there are others that are more important (in my view), but removing dependencies on MySQL hashing functions is definitely a worthwhile plus.

Last edited by net-carver (2011-03-22 22:06:02)

skrishi · 2011-03-22 22:06:39

Thank you.

ruud · 2011-03-22 22:19:06

net-carver wrote:

That’s only one of the advantages of using PHPass, there are others that are more important (in my view), but removing dependencies on MySQL hashing functions is definitely a worthwhile plus.

What are the other, more important advantages?

skrishi · 2011-03-23 01:10:39

I made a plugin, I would like to know your opinion.
I open a new thread, or here in its place? And in what section to open?
And as a code to show? Print this right here, or better yet a link to the page?
Thanks in advance.

Bloke · 2011-03-23 01:33:24

skrishi wrote:

I made a plugin, I would like to know your opinion.

Cool. What three-letter prefix have you chosen for your plugin and all its functions / global variables / class names / etc? I’ll add it to the reserved list in the wiki.

I open a new thread, or here in its place? And in what section to open?

Normally you open a topic in the Plugin Author Support forum but you probably don’t have access yet. Some kind soul will grant you access (I’ve never done it and I’m just about to go to bed, sorry).

And as a code to show? Print this right here, or better yet a link to the page?

Did you make the plugin using the raw template or the plugin composer? Either way it’s usually best to host the resulting .txt file (and/or gzipped .txt file) on your own site and add an entry over at textpattern.org that contains the details and download link. You can register yourself an account I think. There’s an optional link for a Forum Thread URL which directs people here so they can discuss the plugin.

Hope that helps.

skrishi · 2011-03-23 06:00:23

I think it’s too early to talk about full-fledged plugin. He was to have only three tags that you can either insert or not insert.
Only the Russian language. And with my English, it is unlikely I’ll make a good English version.
I would like that to experienced users and plugin authors, have looked the code for vulnerabilities, security bugs.

It is may plugin

If it really looks like a plugin, I can make a theme …

ruud · 2011-03-23 11:49:05

Security:
If this is a public interface, you’re now offering a way to try username/password combinations that is only limited by the amount of page requests your website can handle (brute force attack).

Use proper mime-encoding when sending email, since you’re using characters outside 7-bit us-ascii.

You’re not imposing any limits or restrictions on the passwords entered.

You’re doSlashing ‘$name’ twice. Once is enough.

Style:
Instead of multiple “if empty” constructs which all lead to the same result”, combine them into one (makes the code easier to read):

if (!empty($pass) and !empty($cpass) and !empty($oldpass))
{
  return gvv_gTxt('password_all_back');
}

And then continue with other if constructs. You don’t need “else” here, because the “return” gets you out of the function anyway.

Replace ‘acaunt’ with ‘account’.

Make the forms more flexible instead of hardcoding them (if this is a plugin that will be released to the public).

skrishi · 2011-03-23 17:40:29

Thank you for your opinion. I’ll work on it.

ruud wrote:

You’re doSlashing ‘$name’ twice. Once is enough.

Where better to use doSlashing(): when accessing the database or reading the variables from the form?

Tell me again: how do I do? Next issue will not match the title. I open a new thread, or you can continue here?

ruud · 2011-03-23 18:55:26

I prefer to escape late instead of early, so just before accessing the database.

Textpattern CMS

Textpattern CMS support forum

#13 2011-03-22 19:27:56

Re: How to compare passwords in TXP?

#14 2011-03-22 21:52:58

Re: How to compare passwords in TXP?

#15 2011-03-22 21:59:35

Re: How to compare passwords in TXP?

#16 2011-03-22 22:02:23

Re: How to compare passwords in TXP?

#17 2011-03-22 22:06:39

Re: How to compare passwords in TXP?

#18 2011-03-22 22:19:06

Re: How to compare passwords in TXP?

#19 2011-03-23 01:10:39

Re: How to compare passwords in TXP?

#20 2011-03-23 01:33:24

Re: How to compare passwords in TXP?

#21 2011-03-23 06:00:23

Re: How to compare passwords in TXP?

#22 2011-03-23 11:49:05

Re: How to compare passwords in TXP?

#23 2011-03-23 17:40:29

Re: How to compare passwords in TXP?

#24 2011-03-23 18:55:26

Re: How to compare passwords in TXP?

Board footer