Differences From Artifact [b5167db883]:

• File src/setup.c — part of check-in [cfe33dcf92] at 2010-01-09 22:03:21 on branch experimental — Store passwords in USER.PW as either cleartext (as is done in legacy) or as the SHA1 hash of the password. When changing a password or adding a new user, always use the SHA1 hash password. (user: drh size: 38102)

To Artifact [c0efbd97b5]:

• File src/setup.c — part of check-in [4b58a7b838] at 2010-01-10 20:56:30 on branch experimental — Change the hash algorithm for passwords so that USER.PW field stores a SHA1 hash of the project-code, user login, and user password, rather than just a hash of the user password. That way, the if two users select the same password, or if the one user selects the same password for multiple projects, the password hashes are still different. (user: drh size: 38121) [more...]

316
317
318
319
320
321
322

323
324
325
326
327
328
329
330
331
332
333
334
335

    if( au ){ zCap[i++] = 'u'; }
    if( av ){ zCap[i++] = 'v'; }
    if( aw ){ zCap[i++] = 'w'; }
    if( az ){ zCap[i++] = 'z'; }

    zCap[i] = 0;
    zPw = P("pw");

    if( isValidPwString(zPw) ){
      zPw = sha1sum(zPw);
    }else{
      zPw = db_text(0, "SELECT pw FROM user WHERE uid=%d", uid);
    }
    zLogin = P("login");
    if( uid>0 &&
        db_exists("SELECT 1 FROM user WHERE login=%Q AND uid!=%d", zLogin, uid)
    ){
      style_header("User Creation Error");
      @ <font color="red">Login "%h(zLogin)" is already used by a different
      @ user.</font>
      @

>

|



<

316
317
318
319
320
321
322
323
324
325
326
327
328

329
330
331
332
333
334
335

    if( au ){ zCap[i++] = 'u'; }
    if( av ){ zCap[i++] = 'v'; }
    if( aw ){ zCap[i++] = 'w'; }
    if( az ){ zCap[i++] = 'z'; }

    zCap[i] = 0;
    zPw = P("pw");
    zLogin = P("login");
    if( isValidPwString(zPw) ){
      zPw = sha1_shared_secret(zPw, zLogin);
    }else{
      zPw = db_text(0, "SELECT pw FROM user WHERE uid=%d", uid);
    }

    if( uid>0 &&
        db_exists("SELECT 1 FROM user WHERE login=%Q AND uid!=%d", zLogin, uid)
    ){
      style_header("User Creation Error");
      @ <font color="red">Login "%h(zLogin)" is already used by a different
      @ user.</font>
      @