AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-08-05 15:17:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

Migrate credential password from varbinary to varchar and set max length for passwords

Browse Source
This commit is contained in:
johnnyq
2026-08-02 16:18:36 -04:00
parent 89fba247c5
commit e793804203
4 changed files with 30 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
admin/database_updates/2.6.5.php Normal file
View File

@@ -0,0 +1,26 @@
<?php
/*
* ITFlow - Database update to version 2.6.5 (from 2.6.4)
* Included by admin/database_updates.php - do not access directly
*/
defined('FROM_DB_UPDATER') || die("Direct file access is not allowed");
// credential_password was inherited as VARBINARY(200) when 2.0.0 renamed login_password.
// What it actually stores is a 16-char IV followed by base64 AES-128-CBC ciphertext -
// pure ASCII, the same shape as credential_username (varchar(500)) and
// users.user_specific_encryption_ciphertext (varchar(200)). Nothing compares, indexes,
// sorts or searches on the column, so binary semantics were never buying anything.
//
// The width was the real problem: base64 expands ~1.37x, so 200 bytes capped the
// cleartext at 127 chars while the credential form offered 350. Anything longer
// overflowed and errored the save. varchar(500) matches credential_username and makes
// 350 the correct form limit for both fields.
// Widen while still binary first. If the charset conversion below fails on an install
// with unexpected bytes, the column is at least already wide enough and the app keeps
// working - varbinary(500) holds the same values just fine.
mysqli_query($mysqli, "ALTER TABLE `credentials` MODIFY `credential_password` varbinary(500) DEFAULT NULL");
mysqli_query($mysqli, "ALTER TABLE `credentials` MODIFY `credential_password` varchar(500) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci DEFAULT NULL");

2
agent/modals/asset/asset_add.php
View File

@@ -469,7 +469,7 @@ ob_start();
<div class="input-group-prepend">
<span class="input-group-text"><i class="fa fa-fw fa-lock"></i></span>
</div>
<input type="text" class="form-control" name="password" placeholder="Password" autocomplete="off">
<input type="text" class="form-control" name="password" placeholder="Password" maxlength="350" autocomplete="off">
</div>
</div>

2
agent/modals/asset/asset_copy.php
View File

@@ -432,7 +432,7 @@ ob_start();
<div class="input-group-prepend">
<span class="input-group-text"><i class="fa fa-fw fa-lock"></i></span>
</div>
<input type="text" class="form-control" name="password" placeholder="Password" autocomplete="off">
<input type="text" class="form-control" name="password" placeholder="Password" maxlength="350" autocomplete="off">
</div>
</div>

4
db.sql
View File

@@ -934,7 +934,7 @@ CREATE TABLE `credentials` (
`credential_uri` varchar(500) DEFAULT NULL,
`credential_uri_2` varchar(500) DEFAULT NULL,
`credential_username` varchar(500) DEFAULT NULL,
`credential_password` varbinary(200) DEFAULT NULL,
`credential_password` varchar(500) DEFAULT NULL,
`credential_otp_secret` varchar(200) DEFAULT NULL,
`credential_note` text DEFAULT NULL,
`credential_favorite` tinyint(1) NOT NULL DEFAULT 0,
@@ -3150,4 +3150,4 @@ CREATE TABLE `vendors` (
/*!40101 SET COLLATION_CONNECTION=@OLD_COLLATION_CONNECTION */;
/*!40111 SET SQL_NOTES=@OLD_SQL_NOTES */;
-- Dump completed on 2026-07-31 16:18:11
-- Dump completed on 2026-08-02 16:18:05