h5ai icon indicating copy to clipboard operation
h5ai copied to clipboard

info page - cannot use passhash

Open mozai opened this issue 1 year ago • 0 comments

Using h5ai 0.30.0 , PHP 8.2.9.
No matter what I set passhash to, it won't let me see the info page.

What I tried

  • http://localhost/_h5ai/public/index.php , I'm prompted for a password
  • enter nothing ("the preset password is the empty string"), prompted for password again
  • php <<<'<?php print hash("sha512", "clownjuice") . "\n";' -> get sha512 string 05df04f903...58790fc79
  • edit private/conf/options.json to set passhash to this string
  • http://localhost/_h5ai/public/index.php, enter "clownjuice", I'm prompted for a password again
  • in case my browser is playing shennanigans, use curl instead: curl 'http://localhost/_h5ai/public/index.php?' -X POST --data-raw '{"action":"login","pass":"clownjuice"}' -> I get {"asAdmin":false} as a response

What I did as a workaround

  • edit private/php/core/class-context.php
  • - $this->session->set(Context::$AS_ADMIN_SESSION_KEY, strcasecmp(hash('sha512', $pass), $this->passhash) === 0);
    + $this->session->set(Context::$AS_ADMIN_SESSION_KEY, True);
    
  • Now https://localhost/_h5ai/public/index.php works. When I'm done, I revert the file back to its previous (not-working but more secure) state.

mozai avatar Aug 13 '23 03:08 mozai