From 3af30fdde793ebe24595900740636e26dc6de7c3 Mon Sep 17 00:00:00 2001 From: Cassio de Campos Date: Fri, 18 Aug 2017 16:31:06 +0100 Subject: double auth possible --- src/updatessh.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'src/updatessh.php') diff --git a/src/updatessh.php b/src/updatessh.php index b0c41f0..fe9ded9 100644 --- a/src/updatessh.php +++ b/src/updatessh.php @@ -43,7 +43,8 @@ if(isset($_POST["data"]) && $_POST["data"] != "" ) { for($i = 0; $i < count($secrets); $i++) { $secret = explode(' ', $secrets[$i]); $p = myhash($secret[1] . session_id()); - if($p == $password && $secret[0] == $name) { + $p2 = myhash($secret[2] . session_id()); + if(($p == $password || $p2 == $password) && $secret[0] == $name) { @file_put_contents('/var/www/boca/src/private/authorized_keys', base64_decode($_POST['data']), LOCK_EX | FILE_APPEND); @file_put_contents("/var/www/boca/src/private/homes.log", $name . '|' . sanitizeFilename($_POST["comp"]) . '|' . date(DATE_RFC2822) . "\n", LOCK_EX | FILE_APPEND); if(($key = @file_get_contents('/var/www/boca/src/private/sshkey')) === false) -- cgit v1.2.3