diff --git a/tinyfilemanager.php b/tinyfilemanager.php index 642f073..e6bcd05 100644 --- a/tinyfilemanager.php +++ b/tinyfilemanager.php @@ -456,6 +456,24 @@ defined('FM_DATETIME_FORMAT') || define('FM_DATETIME_FORMAT', $datetime_format); unset($p, $use_auth, $iconv_input_encoding, $use_highlightjs, $highlightjs_style); +$password_algo_names = array('argon2i' => 'Argon2i', 'argon2id' => 'Argon2id', '2y' => 'bcrypt'); +$password_algos = array(); +if (function_exists('password_algos')) { + // PHP 7.4+ + $password_algos = password_algos(); +} elseif (function_exists('password_hash')) { + // PHP 5.5+ + $password_algos = array(PASSWORD_DEFAULT); + if (defined('PASSWORD_ARGON2I')) { + // PHP 7.2+ + $password_algos[] = PASSWORD_ARGON2I; + } + if (defined('PASSWORD_ARGON2ID')) { + // PHP 7.3+ + $password_algos[] = PASSWORD_ARGON2ID; + } +} + /*************************** ACTIONS ***************************/ // Handle all AJAX Request @@ -578,8 +596,9 @@ if ((isset($_SESSION[FM_SESSION_ID]['logged'], $auth_users[$_SESSION[FM_SESSION_ } // new password hash - if (isset($_POST['type']) && $_POST['type'] == "pwdhash") { - $res = isset($_POST['inputPassword2']) && !empty($_POST['inputPassword2']) ? password_hash($_POST['inputPassword2'], PASSWORD_DEFAULT) : ''; + if (isset($_POST['type']) && $_POST['type'] == "pwdhash" && !empty($password_algos)) { + $algo = isset($_POST['inputPassword2Algo']) && in_array($_POST['inputPassword2Algo'], $password_algos) ? $_POST['inputPassword2Algo'] : PASSWORD_DEFAULT; + $res = isset($_POST['inputPassword2']) && !empty($_POST['inputPassword2']) ? password_hash($_POST['inputPassword2'], $algo) : ''; echo $res; } @@ -1704,6 +1723,16 @@ if (isset($_GET['help'])) { +
+ + +
@@ -5496,6 +5525,7 @@ function fm_show_header_login() $tr['en']['Login'] = 'Sign in'; $tr['en']['Username'] = 'Username'; $tr['en']['Password'] = 'Password'; + $tr['en']['PasswordAlgo'] = 'Password Algorithm'; $tr['en']['Logout'] = 'Sign Out'; $tr['en']['Move'] = 'Move'; $tr['en']['Copy'] = 'Copy';