PMG/Utils.pm: encrypt_pw() avoid '+' for crypt salt

And make salt less predictable.

diff --git a/PMG/Utils.pm b/PMG/Utils.pm
index 2e0ee22dbf4a711b86177cddfafd32136b4d9420..9328927f15cce008e2b08547644215865499fa13 100644 (file)
--- a/PMG/Utils.pm
+++ b/PMG/Utils.pm
@@ -107,11 +107,18 @@ sub lastid {
        undef, undef, undef, undef, { sequence => $seq});
 }
 
+my $salt_starter = time();
+
 sub encrypt_pw {
     my ($pw) = @_;
 
-    my $time = substr(Digest::SHA::sha1_base64(time), 0, 8);
-    return crypt(encode("utf8", $pw), "\$5\$$time\$");
+    $salt_starter++;
+    my $salt = substr(Digest::SHA::sha1_base64(time() + $salt_starter + $$), 0, 8);
+
+    # crypt does not want '+' in salt (see 'man crypt')
+    $salt =~ s/\+/X/g;
+
+    return crypt(encode("utf8", $pw), "\$5\$$salt\$");
 }
 
 sub file_older_than {