From 6d5c90139b0e66de163801a4e048ece0a59260bd Mon Sep 17 00:00:00 2001
From: DL6ER <derigs@ph1.uni-koeln.de>
Date: Wed, 16 Nov 2016 22:12:52 +0100
Subject: [PATCH] Compute double hashes to avoid rainbow table vulnerability

---
 header.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/header.php b/header.php
index eb339865..69f1de12 100644
--- a/header.php
+++ b/header.php
@@ -4,8 +4,8 @@
     // Test if password is set
     if(strlen($pwhash) > 0)
     {
-        // Password set
-        if(hash('sha256',$_POST["pw"]) == $pwhash || $_GET["auth"] == $pwhash)
+        // Password set compare with double hash
+        if(hash('sha256',hash('sha256',$_POST["pw"])) == $pwhash || $_GET["auth"] == $pwhash)
         {
             // Password (POST) correct or hash (GET) correct
             $auth = true;