X-Git-Url: https://git-public.kairo.at/?p=authserver.git;a=blobdiff_plain;f=authutils.php-class;fp=authutils.php-class;h=0b7d4b1e2acd4328e7ec0b25cc8160d119dae91e;hp=2d4573f5c76a9cc6dd21ac63c98fc3c90b741011;hb=087085d618e57aea5f292a5bb57d46304574cc6a;hpb=ac442755b476ec15b269be0d6a6c68e5080a6b21

diff --git a/authutils.php-class b/authutils.php-class
index 2d4573f..0b7d4b1 100755
--- a/authutils.php-class
+++ b/authutils.php-class
@@ -15,6 +15,7 @@ class AuthUtils {
   //
   // private $pwd_nonces
   //   The array of nonces to use for "peppering" passwords. For new hashes, the last one of those will be used.
+  //     Generate a nonce with this command: |openssl rand -base64 48|
   //
   // function checkPasswordConstraints($new_password, $user_email)
   //   Check password constraints and return an array of error messages (empty if all constraints are met).
@@ -119,10 +120,12 @@ class AuthUtils {
   }
 
   function pwdVerify($password_to_verify, $userdata) {
-    if (preg_match('/^(\d+)\|/', $userdata['pwdhash'], $regs)) {
+    $pwdhash = $userdata['pwdhash'];
+    if (preg_match('/^(\d+)\|(.+)$/', $userdata['pwdhash'], $regs)) {
       $password_to_verify .= $this->pwd_nonces[$regs[1]];
+      $pwdhash = $regs[2];
     }
-    return password_verify($password_to_verify, $userdata['pwdhash']);
+    return password_verify($password_to_verify, $pwdhash);
   }
 
   function pwdNeedsRehash($userdata) {