Differences From Artifact [04013e80f0]:

• File src/schema.c — part of check-in [cfe33dcf92] at 2010-01-09 22:03:21 on branch experimental — Store passwords in USER.PW as either cleartext (as is done in legacy) or as the SHA1 hash of the password. When changing a password or adding a new user, always use the SHA1 hash password. (user: drh size: 16269)

To Artifact [0b4d483fa4]:

• File src/schema.c — part of check-in [4b58a7b838] at 2010-01-10 20:56:30 on branch experimental — Change the hash algorithm for passwords so that USER.PW field stores a SHA1 hash of the project-code, user login, and user password, rather than just a hash of the user password. That way, the if two users select the same password, or if the one user selects the same password for multiple projects, the password hashes are still different. (user: drh size: 16411) [more...]

97
98
99
100
101
102
103
104


105
106
107
108
109
110
111

@ );
@
@ -- Information about users
@ --
@ -- The user.pw field can be either cleartext of the password, or
@ -- a SHA1 hash of the password.  If the user.pw field is exactly 40
@ -- characters long we assume it is a SHA1 hash.  Otherwise, it is
@ -- cleartext.


@ --
@ CREATE TABLE user(
@   uid INTEGER PRIMARY KEY,        -- User ID
@   login TEXT,                     -- login name of the user
@   pw TEXT,                        -- password
@   cap TEXT,                       -- Capabilities of this user
@   cookie TEXT,                    -- WWW login cookie

|
>
>

97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113

@ );
@
@ -- Information about users
@ --
@ -- The user.pw field can be either cleartext of the password, or
@ -- a SHA1 hash of the password.  If the user.pw field is exactly 40
@ -- characters long we assume it is a SHA1 hash.  Otherwise, it is
@ -- cleartext.  The sha1_shared_secret() routine computes the password
@ -- hash based on the project-code, the user login, and the cleartext
@ -- password.
@ --
@ CREATE TABLE user(
@   uid INTEGER PRIMARY KEY,        -- User ID
@   login TEXT,                     -- login name of the user
@   pw TEXT,                        -- password
@   cap TEXT,                       -- Capabilities of this user
@   cookie TEXT,                    -- WWW login cookie