Password change on blank install

[trustmaster]

Users have reported that changing a password in profile doesn't work on blank 0.6.24 install.

[Cmsworks]

On file system\core\users\users.profile.inc.php:

Need to replace the line 395:

$roldpass = md5($roldpass);

to

$roldpass = sed_hash($roldpass, $urr['user_passsalt'], $urr['user_passfunc']);

and in the line 414:

$rnewpass = md5($rnewpass1);

to

$rpassfunc = empty($cfg['hashfunc']) ? 'sha256' : $cfg['hashfunc'];
$rnewpass = sed_hash($rnewpass1, $urr['user_passsalt'], $rpassfunc);

[trustmaster]

Thanks a lot!

[trustmaster]

It is actually already replaced in our repo. Probably 0.6.24 was packaged wrong.

[Cmsworks]

But in the repository does not have this fix
https://github.com/Cotonti/Cotonti/blob/cotonti-0.6.24/system/core/users/users.profile.inc.php

[trustmaster]

Oh damn, I just forgot to commit this file!