Explorar o código

User authentication fix.

Iñigo Valentin %!s(int64=9) %!d(string=hai) anos
pai
achega
fc0cc43329
Modificáronse 1 ficheiros con 1 adicións e 1 borrados
  1. 1 1
      www/API/v1/sendlocation.php

+ 1 - 1
www/API/v1/sendlocation.php

@@ -64,7 +64,7 @@
 	$action = mysqli_real_escape_string($con, $_GET[GET_ACTION]);
 
 	//Validate user
-	$q = mysqli_query($con, "SELECT id FROM user WHERE username = '$user' AND md5(concat(password, md5(salt))) = '$pass';");
+	$q = mysqli_query($con, "SELECT id FROM user WHERE username = '$user' AND password = '$pass';");
 	if (mysqli_num_rows($q) == 0){
 		error_log(":SECURITY: Reporting location with wrong credentials (IP $_SERVER[REMOTE_ADDR])");
 		http_response_code(403); // Forbidden