From 1f8d1eb4bbe9a764fa69a2da936db7adbfb2941e Mon Sep 17 00:00:00 2001
From: Igor Scheller <igor.scheller@igorshp.de>
Date: Sun, 1 Jan 2017 18:49:43 +0100
Subject: Fixed "Constant already defined" notice

Added more ugly global variables
---
 includes/sys_auth.php | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

(limited to 'includes/sys_auth.php')

diff --git a/includes/sys_auth.php b/includes/sys_auth.php
index 135e49e3..7a1dd4b7 100644
--- a/includes/sys_auth.php
+++ b/includes/sys_auth.php
@@ -39,7 +39,8 @@ function generate_salt($length = 16) {
  * set the password of a user
  */
 function set_password($uid, $password) {
-  $result = sql_query("UPDATE `User` SET `Passwort` = '" . sql_escape(crypt($password, CRYPT_ALG . '$' . generate_salt(16) . '$')) . "', `password_recovery_token`=NULL WHERE `UID` = " . intval($uid) . " LIMIT 1");
+  global $crypt_alg;
+  $result = sql_query("UPDATE `User` SET `Passwort` = '" . sql_escape(crypt($password, $crypt_alg . '$' . generate_salt(16) . '$')) . "', `password_recovery_token`=NULL WHERE `UID` = " . intval($uid) . " LIMIT 1");
   if ($result === false) {
     engelsystem_error('Unable to update password.');
   }
@@ -51,6 +52,7 @@ function set_password($uid, $password) {
  * if $uid is given and $salt is an old-style salt (plain md5), we convert it automatically
  */
 function verify_password($password, $salt, $uid = false) {
+  global $crypt_alg;
   $correct = false;
   if (substr($salt, 0, 1) == '$') { // new-style crypt()
     $correct = crypt($password, $salt) == $salt;
@@ -59,12 +61,12 @@ function verify_password($password, $salt, $uid = false) {
   } elseif (strlen($salt) == 32) { // old-style md5 without salt - not used anymore
     $correct = md5($password) == $salt;
   }
-  
-  if ($correct && substr($salt, 0, strlen(CRYPT_ALG)) != CRYPT_ALG && $uid) {
+
+  if ($correct && substr($salt, 0, strlen($crypt_alg)) != $crypt_alg && $uid) {
     // this password is stored in another format than we want it to be.
     // let's update it!
     // we duplicate the query from the above set_password() function to have the extra safety of checking the old hash
-    sql_query("UPDATE `User` SET `Passwort` = '" . sql_escape(crypt($password, CRYPT_ALG . '$' . generate_salt() . '$')) . "' WHERE `UID` = " . intval($uid) . " AND `Passwort` = '" . sql_escape($salt) . "' LIMIT 1");
+    sql_query("UPDATE `User` SET `Passwort` = '" . sql_escape(crypt($password, $crypt_alg . '$' . generate_salt() . '$')) . "' WHERE `UID` = " . intval($uid) . " AND `Passwort` = '" . sql_escape($salt) . "' LIMIT 1");
   }
   return $correct;
 }
-- 
cgit v1.2.3-54-g00ecf