svn commit: r656515 - in /ofbiz/trunk/framework: base/src/base/org/ofbiz/base/crypto/HashCrypt.java common/src/org/ofbiz/common/login/LoginServices.java

[jonesde]

Author: jonesde
Date: Wed May 14 23:10:50 2008
New Revision: 656515

URL: http://svn.apache.org/viewvc?rev=656515&view=rev
Log:
Reverted fix from Hans that effectively disabled the method to remove the hash type prefix, and fixed the userLogin service code to and fixed the userLogin service code to remove the prefix from the db currentPassword value, which was missing and was causing the problem

Modified:
    ofbiz/trunk/framework/base/src/base/org/ofbiz/base/crypto/HashCrypt.java
    ofbiz/trunk/framework/common/src/org/ofbiz/common/login/LoginServices.java

Modified: ofbiz/trunk/framework/base/src/base/org/ofbiz/base/crypto/HashCrypt.java
URL: http://svn.apache.org/viewvc/ofbiz/trunk/framework/base/src/base/org/ofbiz/base/crypto/HashCrypt.java?rev=656515&r1=656514&r2=656515&view=diff
==============================================================================
--- ofbiz/trunk/framework/base/src/base/org/ofbiz/base/crypto/HashCrypt.java (original)
+++ ofbiz/trunk/framework/base/src/base/org/ofbiz/base/crypto/HashCrypt.java Wed May 14 23:10:50 2008
@@ -81,7 +81,7 @@
     }
     
     public static String removeHashTypePrefix(String hashString) {
-        if (UtilValidate.isNotEmpty(hashString) || hashString.charAt(0) != '{') {
+        if (UtilValidate.isEmpty(hashString) || hashString.charAt(0) != '{') {
             return hashString;
         }
         

Modified: ofbiz/trunk/framework/common/src/org/ofbiz/common/login/LoginServices.java
URL: http://svn.apache.org/viewvc/ofbiz/trunk/framework/common/src/org/ofbiz/common/login/LoginServices.java?rev=656515&r1=656514&r2=656515&view=diff
==============================================================================
--- ofbiz/trunk/framework/common/src/org/ofbiz/common/login/LoginServices.java (original)
+++ ofbiz/trunk/framework/common/src/org/ofbiz/common/login/LoginServices.java Wed May 14 23:10:50 2008
@@ -115,6 +115,7 @@
                     
                     String currentPassword = userLogin.getString("currentPassword");
                     if (useEncryption && currentPassword != null && currentPassword.startsWith("{")) {
+                        // get encode according to the type in the database
                         String dbHashType = HashCrypt.getHashTypeFromPrefix(currentPassword);
                         if (dbHashType != null) {
                             encodedPasswordUsingDbHashType = HashCrypt.getDigestHash(password, dbHashType);
@@ -162,9 +163,9 @@
                         // if the password.accept.encrypted.and.plain property in security is set to true allow plain or encrypted passwords
                         // if this is a system account don't bother checking the passwords
                         if ((userLogin.get("currentPassword") != null &&
-                            (HashCrypt.removeHashTypePrefix(encodedPassword).equals(userLogin.getString("currentPassword")) ||
-                                    HashCrypt.removeHashTypePrefix(encodedPasswordOldFunnyHexEncode).equals(userLogin.getString("currentPassword")) ||
-                                    HashCrypt.removeHashTypePrefix(encodedPasswordUsingDbHashType).equals(userLogin.getString("currentPassword")) ||
+                            (HashCrypt.removeHashTypePrefix(encodedPassword).equals(HashCrypt.removeHashTypePrefix(currentPassword)) ||
+                                    HashCrypt.removeHashTypePrefix(encodedPasswordOldFunnyHexEncode).equals(HashCrypt.removeHashTypePrefix(currentPassword)) ||
+                                    HashCrypt.removeHashTypePrefix(encodedPasswordUsingDbHashType).equals(HashCrypt.removeHashTypePrefix(currentPassword)) ||
                                 ("true".equals(UtilProperties.getPropertyValue("security.properties", "password.accept.encrypted.and.plain")) && password.equals(userLogin.getString("currentPassword")))))) {
                             Debug.logVerbose("[LoginServices.userLogin] : Password Matched", module);