Skip to content
Permalink
Browse files

[SS-2016-008] Reset `Member::Salt` on password change

  • Loading branch information...
dhensby authored and Damian Mooyman committed Jul 15, 2016
1 parent 63937aa commit dc47f7ec9adf67a3f31887467de5b110e8e5b285
Showing with 4 additions and 1 deletion.
  1. +4 −1 security/Member.php
@@ -824,7 +824,7 @@ public static function create_new_password() {
} else {
$random = rand();
$string = md5($random);
$output = substr($string, 0, 6);
$output = substr($string, 0, 8);
return $output;
}
}
@@ -880,6 +880,9 @@ public function onBeforeWrite() {
// Note that this only works with cleartext passwords, as we can't rehash
// existing passwords.
if((!$this->ID && $this->Password) || $this->isChanged('Password')) {
//reset salt so that it gets regenerated - this will invalidate any persistant login cookies
// or other information encrypted with this Member's settings (see self::encryptWithUserSettings)
$this->Salt = '';
// Password was changed: encrypt the password according the settings
$encryption_details = Security::encrypt_password(
$this->Password, // this is assumed to be cleartext

0 comments on commit dc47f7e

Please sign in to comment.
You can’t perform that action at this time.