Code:
if(count <= 0)
{
message = "<font color=\"ee0000\">User Don't Exists</font>";
}
else
{
password_old = pw_encode(login + password_old, MessageDigest.getInstance("MD5"));
/*
// Some hard encoding problems requires a strange solution...
// changePasswd -> wrong encoding password destroyed...
// Only a temp entry in database gives us a correct encoded password for comparsion
rs = statement.executeQuery("call adduser('" + login + "_TEMP_USER', " + password_old + ", '0', '0', '0', '0', '', '0', '0', '0', '0', '0', '0', '0', '', '', " + password_old + ")");
rs = statement.executeQuery("SELECT passwd FROM users WHERE name='" + login + "_TEMP_USER'");
rs.next();
password_old = rs.getString("passwd");
// Delete temp entry
statement.executeUpdate("DELETE FROM users WHERE name='" + login + "_TEMP_USER'");
if(password_old.compareTo(password_stored) != 0)
{
message = "<font color=\"ee0000\">Old Password Mismatch</font>";
}
else
{
password_new = pw_encode(login + password_new, MessageDigest.getInstance("MD5"));
// LOCK TABLE to ensure that nobody else get the original ID of the user
statement.executeUpdate("LOCK TABLE users WRITE");
// Delete old entry
statement.executeUpdate("DELETE FROM users WHERE name='" + login + "'");
// Add new entry
rs = statement.executeQuery("call adduser('" + login + "', " + password_new + ", '0', '0', '0', '0', '', '0', '0', '0', '0', '0', '0', '0', '', '', " + password_new + ")");
// change new entry ID to original ID - necessary to keep characters of this account
statement.executeUpdate("UPDATE users SET ID='" + id_stored + "' WHERE name='" + login + "'");
// UNLOCK TABLES
statement.executeUpdate("UNLOCK TABLES");
message = "<font color=\"00cc00\">Password Changed</font>";
}
*/
CallableStatement cs = connection.prepareCall("{call acquireuserpasswd(?,?,?)}");
cs.setString(1, login);
cs.registerOutParameter(3, Types.VARCHAR);
cs.execute();
if(password_old.compareTo(cs.getString(3)) != 0)
{
message = "<font color=\"ee0000\">Old Password Mismatch</font>";
}
else
{
password_new = pw_encode(login + password_new, MessageDigest.getInstance("MD5"));
statement.executeQuery("CALL changePasswd('" + login + "', " + password_new + ")");
statement.executeQuery("CALL changePasswd2('" + login + "', " + password_new + ")");
message = "<font color=\"00cc00\">Password Changed</font>";
}
}