h5ai
h5ai copied to clipboard
info page - cannot use passhash
Using h5ai 0.30.0 , PHP 8.2.9.
No matter what I set passhash to, it won't let me see the info page.
What I tried
- http://localhost/_h5ai/public/index.php , I'm prompted for a password
- enter nothing ("the preset password is the empty string"), prompted for password again
-
php <<<'<?php print hash("sha512", "clownjuice") . "\n";'
-> get sha512 string 05df04f903...58790fc79 - edit private/conf/options.json to set passhash to this string
- http://localhost/_h5ai/public/index.php, enter "clownjuice", I'm prompted for a password again
- in case my browser is playing shennanigans, use curl instead:
curl 'http://localhost/_h5ai/public/index.php?' -X POST --data-raw '{"action":"login","pass":"clownjuice"}'
-> I get{"asAdmin":false}
as a response
What I did as a workaround
- edit private/php/core/class-context.php
-
- $this->session->set(Context::$AS_ADMIN_SESSION_KEY, strcasecmp(hash('sha512', $pass), $this->passhash) === 0); + $this->session->set(Context::$AS_ADMIN_SESSION_KEY, True);
- Now https://localhost/_h5ai/public/index.php works. When I'm done, I revert the file back to its previous (not-working but more secure) state.