New re-hashing of passords while login should work now

[mailer.git] / inc / modules / admin / admin-inc.php

diff --git a/inc/modules/admin/admin-inc.php b/inc/modules/admin/admin-inc.php
index ed245b5394ebca724e77b605630c6283edea495d..4d3cde5ab730a03bba13a61e79b3832635ce4f97 100644 (file)
--- a/inc/modules/admin/admin-inc.php
+++ b/inc/modules/admin/admin-inc.php
@@ -97,6 +97,9 @@ function CHECK_ADMIN_LOGIN ($admin_login, $password)
 
        // Check if password is same
        if (($ret == "pass") && ($pass == generateHash($password, $salt)) && (!empty($salt)))   {
+               // Change the passord hash here
+               $pass = generateHash($password);
+
                // Update password
                $result = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_admins SET password='%s' WHERE login='%s' LIMIT 1",
                 array($pass, $admin_login), __FILE__, __LINE__);
@@ -106,15 +109,39 @@ function CHECK_ADMIN_LOGIN ($admin_login, $password)
                        if ($cacheInstance->cache_file("admins", true)) $cacheInstance->cache_destroy();
                }
 
-               // Password matches!
-               $ret = "done";
+               // Login has failed by default... ;-)
+               $ret = "failed";
+
+               // Password matches so login here
+               if (LOGIN_ADMIN($admin_login, $pass)) {
+                       // All done now
+                       $ret = "done";
+               }
        } elseif ((empty($salt)) && ($ret == "pass")) {
                // Something bad went wrong
                $ret = "failed";
        }
+
+       // Return the result
        return $ret;
 }
 
+// Try to login the admin by setting some session/cookie variables
+function LOGIN_ADMIN ($adminLogin, $passHash) {
+       // Now set all session variables and return the result
+       return (
+               (
+                       set_session("admin_md5", generatePassString($passHash))
+               ) && (
+                       set_session("admin_login", $adminLogin)
+               ) && (
+                       set_session("admin_last", time())
+               ) && (
+                       set_session("admin_to", $_POST['timeout'])
+               )
+       );
+}
+
 // Only be executed on cookie checking
 function CHECK_ADMIN_COOKIES ($admin_login, $password) {
        global $cacheArray, $_CONFIG;