X-Git-Url: http://wagnertech.de/git?a=blobdiff_plain;f=WEB-INF%2Flib%2Fauth%2FAuth_db.class.php;h=937ad3cc9286adcb1a8d5667ef50ee3b58764924;hb=bd92aeb3404ed8625272abccc9a8766f13ab75e6;hp=4861552c77f571e537d1cc00da558e5884a7bdb8;hpb=c8144edb537a2447d78cda4a2e6c53616a63c876;p=timetracker.git

diff --git a/WEB-INF/lib/auth/Auth_db.class.php b/WEB-INF/lib/auth/Auth_db.class.php
index 4861552c..937ad3cc 100644
--- a/WEB-INF/lib/auth/Auth_db.class.php
+++ b/WEB-INF/lib/auth/Auth_db.class.php
@@ -44,8 +44,8 @@ class Auth_db extends Auth {
     $mdb2 = getConnection();
 
     // Try md5 password match first.
-    $sql = "SELECT id FROM tt_users
-      WHERE login = ".$mdb2->quote($login)." AND password = md5(".$mdb2->quote($password).") AND status = 1";
+    $sql = "SELECT id FROM tt_users".
+      " WHERE login = ".$mdb2->quote($login)." AND password = md5(".$mdb2->quote($password).") AND status = 1";
 
     $res = $mdb2->query($sql);
     if (is_a($res, 'PEAR_Error')) {
@@ -71,7 +71,10 @@ class Auth_db extends Auth {
         WHERE login = ".$mdb2->quote($login)." AND password = old_password(".$mdb2->quote($password).") AND status = 1";
       $res = $mdb2->query($sql);
       if (is_a($res, 'PEAR_Error')) {
-        die($res->getMessage());
+        return false; // Simply return false for a meaningful error message on screen, see the comment below.
+        // die($res->getMessage()); // old_password() function is removed in MySQL 5.7.5.
+                                    // We are getting a confusing "MDB2 Error: not found" in this case if we die.
+        // TODO: perhaps it's time to simplify things and remove handling of old passwords completely.
       }
       $val = $res->fetchRow();
       if ($val['id'] > 0) {
@@ -81,8 +84,9 @@ class Auth_db extends Auth {
 
     // Special handling for admin@localhost - search for an account with admin role with a matching password.
     if ($login == 'admin@localhost') {
-      $sql = "SELECT id, login FROM tt_users
-        WHERE role = 1024 AND password = md5(".$mdb2->quote($password).") AND status = 1";
+      $sql = "SELECT u.id, u.login FROM tt_users u".
+        " LEFT JOIN tt_roles r on (u.role_id = r.id)".
+        " WHERE r.rank = 1024 AND password = md5(".$mdb2->quote($password).") AND u.status = 1";
       $res = $mdb2->query($sql);
       if (is_a($res, 'PEAR_Error')) {
         die($res->getMessage());