* complete task #209:identify function of module user support encrypted authentication.

bin/computeburn.php

@@ -33,8 +33,9 @@ $snoopy->fetch($sessionAPI);
 $session = json_decode($snoopy->results);
 
 /*用户登录*/
+$authHash = md5(md5($password) . $session->rand);
 $submitVars["account"]  = $account; 
-$submitVars["password"] = $password;
+$submitVars["password"] = $authHash;
 $snoopy->cookies[$session->sessionName] = $session->sessionID;
 $snoopy->submit($loginAPI, $submitVars);
 

module/api/control.php

@@ -26,8 +26,10 @@ class api extends control
     /* 获得sessionid。*/
     public function getSessionID()
     {
+        $this->session->set('rand', mt_rand(0, 10000));
         $this->view->sessionName = session_name();
         $this->view->sessionID   = session_id();
+        $this->view->rand        = $this->session->rand;
         $this->display();
     }
 

module/user/model.php

@@ -168,9 +168,14 @@ class userModel extends model
 
         $user = $this->dao->select('*')->from(TABLE_USER)
             ->where('account')->eq($account)
+            ->beginIF(strlen($password) != 32)
             ->andWhere('password')->eq(md5($password))
+            ->fi()
             ->andWhere('deleted')->eq(0)
             ->fetch();
+
+        if(strlen($password) == 32) $user = ($password == md5($user->password . $this->session->rand))?$user:'';
+
         if($user)
         {
             $ip   = $_SERVER['REMOTE_ADDR'];