From fc99a0654690f045805b4f0bfc0c5fca6d7fa068 Mon Sep 17 00:00:00 2001
From: "terry%mozilla.org"
 <terry%mozilla.org@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Tue, 18 Jan 2000 14:40:21 +0000
Subject: [PATCH] Stop ever using perl's crypt() function; only use mysql's. 
 (Using both was causing corruption on about 1 in 40 passwords.)

git-svn-id: svn://10.0.0.236/trunk@58093 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/webtools/bugzilla/CGI.pl             |  5 ++++-
 mozilla/webtools/bugzilla/changepassword.cgi | 18 ++++++------------
 mozilla/webtools/bugzilla/editusers.cgi      | 10 +---------
 3 files changed, 11 insertions(+), 22 deletions(-)

diff --git a/mozilla/webtools/bugzilla/CGI.pl b/mozilla/webtools/bugzilla/CGI.pl
index 41667dd2cb4..5f7a21f882b 100644
--- a/mozilla/webtools/bugzilla/CGI.pl
+++ b/mozilla/webtools/bugzilla/CGI.pl
@@ -604,7 +604,10 @@ sub confirm_login {
             exit;
         }
 
-	my $enteredcryptpwd = crypt($enteredpwd, substr($realcryptpwd, 0, 2));
+        SendSQL("SELECT encrypt(" . SqlQuote($enteredpwd) . ", " .
+                SqlQuote(substr($realcryptpwd, 0, 2)) . ")");
+        my $enteredcryptpwd = FetchOneColumn();
+
         if ($realcryptpwd eq "" || $enteredcryptpwd ne $realcryptpwd) {
             print "Content-type: text/html\n\n";
 	    PutHeader("Login failed");
diff --git a/mozilla/webtools/bugzilla/changepassword.cgi b/mozilla/webtools/bugzilla/changepassword.cgi
index d62259ac5f7..93b736e55b6 100755
--- a/mozilla/webtools/bugzilla/changepassword.cgi
+++ b/mozilla/webtools/bugzilla/changepassword.cgi
@@ -102,11 +102,6 @@ The two passwords you entered did not match.  Please click <b>Back</b> and try a
 my $pwd = $::FORM{'pwd1'};
 
 
-sub x {
-    my $sc="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789./";
-    return substr($sc, int (rand () * 100000) % (length ($sc) + 1), 1);
-}
-
 if ($pwd ne "") {
     if ($pwd !~ /^[a-zA-Z0-9-_]*$/ || length($pwd) < 3 || length($pwd) > 15) {
         print "<H1>Sorry; we're picky.</H1>
@@ -119,14 +114,13 @@ Please click <b>Back</b> and try again.\n";
     }
     
     
-# Generate a random salt.
-    
-    my $salt  = x() . x();
-    
-    my $encrypted = crypt($pwd, $salt);
-    
-    SendSQL("update profiles set password='$pwd',cryptpassword='$encrypted' where login_name=" .
+    my $qpwd = SqlQuote($pwd);
+    SendSQL("UPDATE profiles SET password=$qpwd,cryptpassword=encrypt($qpwd) 
+             WHERE login_name = " .
             SqlQuote($::COOKIE{'Bugzilla_login'}));
+    SendSQL("SELECT cryptpassword FROM profiles WHERE login_name = " .
+            SqlQuote($::COOKIE{'Bugzilla_login'}));
+    my $encrypted = FetchOneColumn();
     
     SendSQL("update logincookies set cryptpassword = '$encrypted' where cookie = $::COOKIE{'Bugzilla_logincookie'}");
 }
diff --git a/mozilla/webtools/bugzilla/editusers.cgi b/mozilla/webtools/bugzilla/editusers.cgi
index ccb108e7928..5b5d7e526fe 100755
--- a/mozilla/webtools/bugzilla/editusers.cgi
+++ b/mozilla/webtools/bugzilla/editusers.cgi
@@ -277,21 +277,13 @@ if ($action eq 'new') {
     }
     
 
-    sub x {
-	my $sc="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789./";
-	return substr($sc, int (rand () * 100000) % (length ($sc) + 1), 1);
-    }
-
-    my $salt = x() . x();
-    my $cryptpassword = crypt($password, $salt);
-
     # Add the new user
     SendSQL("INSERT INTO profiles ( " .
           "login_name, password, cryptpassword, realname, groupset" .
           " ) VALUES ( " .
           SqlQuote($user) . "," .
           SqlQuote($password) . "," .
-          SqlQuote($cryptpassword) . "," .
+          "encrypt(" . SqlQuote($password) . ")," .
           SqlQuote($realname) . "," .
           $bits . ")" );