From d899293c67798c504f0081f22bc5bb40d71eb840 Mon Sep 17 00:00:00 2001
From: DL6ER <derigs@ph1.uni-koeln.de>
Date: Sat, 19 Nov 2016 22:05:26 +0100
Subject: [PATCH] Test if POST and GET variables are set before trying to
 actually access them. This increases code complexity noticable, let's see if
 codacy complains ...

---
 php/password.php | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/php/password.php b/php/password.php
index 6f81c7f5..517fb965 100644
--- a/php/password.php
+++ b/php/password.php
@@ -4,12 +4,18 @@
     // Test if password is set
     if(strlen($pwhash) > 0)
     {
-        // Password set compare with double hash
-        if(hash('sha256',hash('sha256',$_POST["pw"])) == $pwhash || $_GET["auth"] == $pwhash)
+        // Compare doubly hashes password input with saved hash
+        if(isset($_POST["pw"]))
         {
-            // Password (POST) correct or hash (GET) correct
-            $auth = true;
-            $pwstring = "auth=".$pwhash;
+            $postinput = hash('sha256',hash('sha256',$_POST["pw"]));
+            if($postinput == $pwhash)
+                $auth = true;
+        }
+        // Compare auth hash with saved hash
+        else if (isset($_GET["auth"]))
+        {
+            if($_GET["auth"] == $pwhash)
+                $auth = true;
         }
         else
         {
@@ -17,6 +23,10 @@
             $auth = false;
             $pwstring = "";
         }
+        // If authorized, then set the hash that will be
+        // passed through using GET
+        if($auth)
+            $pwstring = "auth=".$pwhash;
     }
     else
     {