--- helpers/basic_auth/DB/squid_db_auth.in.orig 2010-05-03 18:36:22.000000000 +0200 +++ helpers/basic_auth/DB/squid_db_auth.in 2010-05-07 22:54:50.000000000 +0200 @@ -1,8 +1,9 @@ #!@PERL@ -use strict; +#use strict; use DBI; use Getopt::Long; use Pod::Usage; +use Digest::MD5 qw(md5 md5_hex md5_base64); $|=1; =pod @@ -22,6 +23,10 @@ my $db_cond = "enabled = 1"; my $plaintext = 0; my $persist = 0; +my $isjoomla = 0; +my $debug = 0; +my $hashsalt = undef; +my $sql = undef; =pod @@ -62,15 +67,30 @@ =item B<--cond> Condition, defaults to enabled=1. Specify 1 or "" for no condition +If you use --joomla flag, this condition will be changed to block=0 =item B<--plaintext> Database contains plain-text passwords +=item B<--salt> + +Selects the correct salt to evaluate passwords + =item B<--persist> Keep a persistent database connection open between queries. +=item B<--joomla> + +Tells helper that user database is joomla db. So salt hasing is +understood. + +=item B<--sql> + +Tells the helper that this query will be used. Remember to use ? +(question mark) in a sentence search username like: "WHERE user = ?" + =back =cut @@ -85,9 +105,14 @@ 'cond=s' => \$db_cond, 'plaintext' => \$plaintext, 'persist' => \$persist, + 'joomla' => \$isjoomla, + 'debug' => \$debug, + 'salt=s' => \$hashsalt, + 'sql=s' => \$sql, ); my ($_dbh, $_sth); +$db_cond = "block = 0" if $isjoomla; sub close_db() { @@ -105,7 +130,16 @@ warn ("Could not connect to $dsn\n"); return undef; } - $_sth = $_dbh->prepare("SELECT $db_passwdcol FROM $db_table WHERE $db_usercol = ?" . ($db_cond ne "" ? " AND $db_cond" : "")) || die; + my $sql_query; + + if (!defined $sql) { + $sql_query = "SELECT $db_passwdcol FROM $db_table WHERE $db_usercol = ?" . ($db_cond ne "" ? " AND $db_cond" : ""); + } + else{ + $sql_query = $sql; + } + + $_sth = $_dbh->prepare($sql_query) || die; return $_sth; } @@ -113,9 +147,19 @@ { my ($password, $key) = @_; - return 1 if crypt($password, $key) eq $key; - - return 1 if $plaintext && $password eq $key; + if ($isjoomla){ + my $salt; + my $key2; + ($key2,$salt) = split (/$salt/, $key); + return 1 if md5_hex($password.$salt).':'.$salt eq $key; + } + else{ + + return 1 if defined $hashsalt && crypt($password, $hashsalt) eq $key; + return 1 if crypt($password, $key) eq $key; + + return 1 if $plaintext && $password eq $key; + } return 0; } @@ -155,6 +199,7 @@ =head1 COPYRIGHT Copyright (C) 2007 Henrik Nordstrom +Copyright (C) 2010 Luis Daniel Lucio Quiroz (Joomla support) This program is free software. You may redistribute copies of it under the terms of the GNU General Public License version 2, or (at youropinion) any later version.