From 233d42fb17547f5de4027de4ab6fbdcb0e05a8b9 Mon Sep 17 00:00:00 2001
From: fujia <yuren_@126.com>
Date: Wed, 30 Jun 2010 10:03:32 +0000
Subject: [PATCH]  * complete task #209:identify function of module user
 support encrypted authentication.

---
 bin/computeburn.php    | 3 ++-
 module/api/control.php | 2 ++
 module/user/model.php  | 5 +++++
 3 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/bin/computeburn.php b/bin/computeburn.php
index a2c52e0d48..6e7d192a83 100755
--- a/bin/computeburn.php
+++ b/bin/computeburn.php
@@ -33,8 +33,9 @@ $snoopy->fetch($sessionAPI);
 $session = json_decode($snoopy->results);
 
 /*用户登录*/
+$authHash = md5(md5($password) . $session->rand);
 $submitVars["account"]  = $account; 
-$submitVars["password"] = $password;
+$submitVars["password"] = $authHash;
 $snoopy->cookies[$session->sessionName] = $session->sessionID;
 $snoopy->submit($loginAPI, $submitVars);
 
diff --git a/module/api/control.php b/module/api/control.php
index be3336f6a7..d958ee8fa4 100644
--- a/module/api/control.php
+++ b/module/api/control.php
@@ -26,8 +26,10 @@ class api extends control
     /* 获得sessionid。*/
     public function getSessionID()
     {
+        $this->session->set('rand', mt_rand(0, 10000));
         $this->view->sessionName = session_name();
         $this->view->sessionID   = session_id();
+        $this->view->rand        = $this->session->rand;
         $this->display();
     }
 
diff --git a/module/user/model.php b/module/user/model.php
index c2a78b33b3..11f5b8e2f5 100644
--- a/module/user/model.php
+++ b/module/user/model.php
@@ -168,9 +168,14 @@ class userModel extends model
 
         $user = $this->dao->select('*')->from(TABLE_USER)
             ->where('account')->eq($account)
+            ->beginIF(strlen($password) != 32)
             ->andWhere('password')->eq(md5($password))
+            ->fi()
             ->andWhere('deleted')->eq(0)
             ->fetch();
+
+        if(strlen($password) == 32) $user = ($password == md5($user->password . $this->session->rand))?$user:'';
+
         if($user)
         {
             $ip   = $_SERVER['REMOTE_ADDR'];