解決DiscuzX3.3登入頁面密碼明文傳輸問題
阿新 • • 發佈:2019-01-26
1、UC_SERVER登入頁面修改:
D:\Apache24\htdocs\uc_server\data\view\admin_login.php
第三行新增:
<script type="text/javascript" src="../static/js/md5.js"></script>
33行修改為:
<p>密 碼: <input type="password" name="password" class="txt" tabindex="2" id="password" onblur="this.value = hex_md5(this.value);" /></p>
後臺修改:
D:\Apache24\htdocs\uc_server\control\admin\user.php的function onlogin()方法
76行:
$md5password = md5(md5($password).UC_FOUNDERSALT);
修改為
$md5password = md5($password.UC_FOUNDERSALT);
86行:
$md5password = md5(md5($password).$admin['salt']);
修改為
$md5password = md5($password .$admin['salt']);
2、DISCUZ管理中心登入頁面修改:
D:\Apache24\htdocs\source\admincp\admincp_login.php檔案
55行新增:
<script type="text/javascript" src="../static/js/md5.js"></script>
120行:
<p class="loginform"><input name="admin_password" tabindex="1" type="password" class="txt" autocomplete="off" /></p>
修改為
<p class="loginform"><input name="admin_password" tabindex="1" type="password" class="txt" autocomplete="off" onblur="this.value=hex_md5(this.value)"/></p>
D:\Apache24\htdocs\uc_client\model\user.php的check_login(
123行:
elseif($user['password'] != md5(md5($password).$user['salt']))
修改為
elseif($user['password'] != md5($password.$user['salt']))