[RESOLVED] Replacing a word in a file

[iNFERiON]

I am trying to replace a word in a file. I have a file that works as password database, it hold the md5 encrypted passwords of users, like this:

// User 01 - John
$pass[John] = "md5.hash.here"; // Edited for security obviously ;)
$user[John] = "John";
$group[John] = "admin";

// User 02 - Rob
$pass[Rob] = "none";
$user[Rob] = "Rob";
$group[Rob] = "user";

As you see, the 2nd user does not have a valid md5 hash. I want to give these users the oppurtunity to enter a new password for themselves. I tried the following:

// Chunk of login.php
if($pass[$_POST['user']] == "none") { include('setpass.php'); exit; }

// Chunk of setpass.php

// This opens the password file
$pf = fopen('password.db','w') or die ('Woops, this is wrong.<br>Error code: 104');
// This set the source piece of text, currently in the password file
$sp = $pass[$_SESSION['user']];
$ep = "$sp = \"none\";";

// This should replace the string "none" with the md5'ed password.
$rep1 = "none";
$rep2 = md5($_POST['nwpass']);
$newpass = str_replace($rep1, $rep2, $ep);

// This should write the str_replace to the file
$setnwpass = fwrite($pf, $newpass) or die ('You should not see this.<br>Error code: 105');
fclose($pf);
exit;
}

However, when the user logs in, he does get the prompt that he can change his password, but when something is entered, the password database file is emptied and all it says afterwards is, and I quote:

= "md.hash.here";

What am I overlooking ?

[suntra]

The problem, I think, is the file opening mode, i.e. the 'w' parameter in fopen(). By using 'w', you reset the contents of the file. So I suggest you to use 'r+' instead. Also, I think you should consider revising another part of your code... if you replace 'none' by the new password, you will replace ALL the 'none' passwords !!! You should replace the 'search' parameter and the 'replace' parameter by this:

$rep1 = '$pass[' . $_POST['user'] . '] = "none"'; 
$rep2 = '$pass[' . $_POST['nwpass'] . '] = "' . md5($_POST['nwpass']) . '"';

Also, is the passwords file included AND executed in your script ? If yes, you should put the username between quotes to avoid errors 😉

[iNFERiON]

suntra wrote:

The problem, I think, is the file opening mode, i.e. the 'w' parameter in fopen(). By using 'w', you reset the contents of the file. So I suggest you to use 'r+' instead. Also, I think you should consider revising another part of your code... if you replace 'none' by the new password, you will replace ALL the 'none' passwords !!! You should replace the 'search' parameter and the 'replace' parameter by this:

$rep1 = '$pass[' . $_POST['user'] . '] = "none"'; 
$rep2 = '$pass[' . $_POST['nwpass'] . '] = "' . md5($_POST['nwpass']) . '"';

Also, is the passwords file included AND executed in your script ? If yes, you should put the username between quotes to avoid errors 😉

Thanks for that code, that may be better indeed. As for changing the fopen mode, it didn't really help, now it puts:

 = "none";

at the beginning of the file, overwriting the first few characters. :/
So now the header has become:

 = "none";.php - Password database

What used to be:

// pass.php - Password database

.

But looking at the fopen explanation on php.net I see that almost all read-modes say "place the file pointer at the beginning of the file." which, is not what I want, I want the pointer to go to the specified string, any way of doing this ?

[iNFERiON]

After some more coding and debugging, I now have this:

	$pf = fopen('password.db','r+') or die ('Woops, this is not right.<br>Error code: 104');
	$newpass = str_replace("none", md5($_POST['nwpass']), "\$pass[" . $_SESSION['user'] . "] = \"none\";");
	$setnwpass = fwrite($pf, $newpass) or die ('You should not be seeing this.<br>Error code: 105');
	fclose($pf);

It does write the correct value to the file, but again at the start of the file, overwriting the first few characters. How can I set the pointer to the right position, I still have not figured that out.

[Installer]

Try this:

$find = '$pass[' . $_SESSION['user'] . '] = ';
$replace = $find . '"' . md5($_POST['nwpass']) . "\";\n";
$lines = file('password.db');
foreach ($lines as $key => $line) {
    if (strpos($line, $find) !== false) {
        $lines[$key] = $replace;
        break;
    }
}

$pf = fopen('password.db','w') 
    or die ('Whoops, this is wrong.<br>Error code: 104'); 
fwrite($pf, implode('', $lines));
fclose($pf);

Edit: Mistakes corrected.

[iNFERiON]

Hmm, that doesn't seem to write anything at all.

[Installer]

It works for me. Did you use the edited version?

[iNFERiON]

Yes I did, but nevertheless, I have found another way to achieve what I want. I now added a option in my admin panel that requires 4 field to be filled out, Name, Username, Password and Group. A new user will then be added, instead of an existing user being edite (what I tried first) The script then does the following:

$au = fopen('password.db','a');
$predata = "// User " . $_POST['nwuser'] . "\n";
$data1 = "\$pass[" . $_POST['nwuser'] . "] = \"" . md5($_POST['nwuserpass']) . "\";\n";
$data2 = "\$user[" . $_POST['nwuser'] . "] = \"" . $_POST['firstname'] . "\";\n";
$data3 = "\$group[" . $_POST['nwuser'] . "] = \"" . $_POST['nwusergroup'] . "\";\n\n";
fwrite($au, $predata);
echo "Writing password...";
fwrite($au, $data1);
echo " Done !<br>";
echo "Writing name...";
fwrite($au, $data2);
echo " Done !<br>";
echo "Writing group...";
fwrite($au, $data3);
echo " Done !<br>";
fclose($au);
echo "Click <a href=\"admin.php\">here</a> to go back.";

This works excellent 🙂

[Installer]

No problem.