Fixed: FS#3718 - SQL injection checker false positive alert in APS installer

Till Brehm

2014-10-27 0e34bade9cc2fa831f9c8a344b2ebfdf4047848c

 interface/web/login/index.php

@@ -160,7 +160,7 @@
               } else {
                  if(stristr($username, '@')) {
                     //* mailuser login
                     $sql = "SELECT * FROM mail_user WHERE login = '$username'";
                     $sql = "SELECT * FROM mail_user WHERE login = '$username' or email = '$username'";
                     $mailuser = $app->db->queryOneRecord($sql);
                     $user = false;
                     if($mailuser) {
@@ -201,7 +201,7 @@
                              $user = false;
                           }
                        } elseif(substr($saved_password, 0, 3) == '$5$') {
                           //* The password is crypt-md5 encrypted
                           //* The password is crypt-sha256 encrypted
                           $salt = '$5$'.substr($saved_password, 3, 16).'$';

                           if(crypt(stripslashes($passwort), $salt) != $saved_password) {
@@ -325,6 +325,15 @@
         $error = '<div class="box box_error"><h1>Error</h1>'.$error.'</div>';
      }
      
      $app->load('getconf');

      $security_config = $app->getconf->get_security_config('permissions');
      if($security_config['password_reset_allowed'] == 'yes') {
         $app->tpl->setVar('pw_lost_show', 1);
      } else {
         $app->tpl->setVar('pw_lost_show', 0);
      }
		
      $app->tpl->setVar('error', $error);
      $app->tpl->setVar('pw_lost_txt', $app->lng('pw_lost_txt'));
      $app->tpl->setVar('username_txt', $app->lng('username_txt'));