Need to make some php reports, but need it to be secured, how can I deal with user passwords ?

[HF]

Can I use md5() function to check the user password ?

[Anand Doshi]

Hi HF,

I don't know the context of what you are trying to develop.

Here are my general recommendations.

MySQL has an inbuilt password type. You can use that to store passwords. That way, mysql will take care of the hashing, and you wont need to store password in plain text.

However, if you do want to use hashing algorithms, use sha256 or higher, instead of md5, as md5 has already been compromised.

Python has a module called hashlib. You can use its methods to implement any hashing, using preferably sha256 or higher. [http://docs.python.org/library/hashlib.html]

Thanks,

Anand.

Sent with Sparrow

On Sunday 22 July 2012 at 3:45 PM, HF wrote:

Can I use md5() function to check the user password ?

--
You received this message because you are subscribed to the Google Groups "ERPNext Developer Forum" group.
To post to this group, send email to erpnext-dev...@googlegroups.com.
To unsubscribe from this group, send email to erpnext-developer...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msg/erpnext-developer-forum/-/GkJ19BcciQsJ.
For more options, visit https://groups.google.com/groups/opt_out.
 
 

[HF]

Hi Anand; 

I need to authenticate ERPNext users from the tabProfile table in my php reports.

How can I check if user password correct ?

[Anand Doshi]

Hi,

Just use this query:

select * from `tabProfile` where name = [username] and password = password( [password] )

if the result exists, then the user is authenticated..

Thanks,

Anand.

Sent with Sparrow

--
You received this message because you are subscribed to the Google Groups "ERPNext Developer Forum" group.
To post to this group, send email to erpnext-dev...@googlegroups.com.
To unsubscribe from this group, send email to erpnext-developer...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msg/erpnext-developer-forum/-/aEcTyNU1_uwJ.

[HF]

Thank you Anand, it works ... Thanks a lot.

On Sunday, July 22, 2012 12:15:35 PM UTC+2, HF wrote: