summaryrefslogtreecommitdiffstats
path: root/web/html/passreset.php
diff options
context:
space:
mode:
Diffstat (limited to 'web/html/passreset.php')
-rw-r--r--web/html/passreset.php5
1 files changed, 4 insertions, 1 deletions
diff --git a/web/html/passreset.php b/web/html/passreset.php
index 6fbd1ca..0f98593 100644
--- a/web/html/passreset.php
+++ b/web/html/passreset.php
@@ -31,10 +31,13 @@ if (isset($_GET['resetkey'], $_POST['email'], $_POST['password'], $_POST['confir
if (empty($error)) {
$dbh = db_connect();
+ $salt = generate_salt();
+ $hash = salted_hash($password, $salt);
# The query below won't affect any records unless the ResetKey
# and Email combination is correct and ResetKey is nonempty
$q = "UPDATE Users
- SET Passwd = '".md5($password)."',
+ SET Passwd = '$hash',
+ Salt = '$salt',
ResetKey = ''
WHERE ResetKey != ''
AND ResetKey = '".mysql_real_escape_string($resetkey)."'