Implemented password hashing using a salt, following this code&guidelines: https://crackstation.net/hashing-security.htm

2 files changed, 3 insertions, 3 deletions

diff --git a/src/org/traccar/http/MainServlet.java b/src/org/traccar/http/MainServlet.java
index 18430f0c3..cf6e81286 100644
--- a/src/org/traccar/http/MainServlet.java
+++ b/src/org/traccar/http/MainServlet.java
@@ -67,7 +67,7 @@ public class MainServlet extends BaseServlet {
 
     private void register(HttpServletRequest req, HttpServletResponse resp) throws Exception {
         User user = JsonConverter.objectFromJson(req.getReader(), new User());
-        Context.getDataManager().addUser(user);
+        Context.getDataManager().addUser(user, user.getPassword());
         sendResponse(resp.getWriter(), true);
     }
 
diff --git a/src/org/traccar/http/UserServlet.java b/src/org/traccar/http/UserServlet.java
index f388326b0..197ef0326 100644
--- a/src/org/traccar/http/UserServlet.java
+++ b/src/org/traccar/http/UserServlet.java
@@ -47,14 +47,14 @@ public class UserServlet extends BaseServlet {
     private void add(HttpServletRequest req, HttpServletResponse resp) throws Exception {
         User user = JsonConverter.objectFromJson(req.getReader(), new User());
         Context.getPermissionsManager().checkUser(getUserId(req), user.getId());
-        Context.getDataManager().addUser(user);
+        Context.getDataManager().addUser(user, user.getPassword());
         sendResponse(resp.getWriter(), JsonConverter.objectToJson(user));
     }
     
     private void update(HttpServletRequest req, HttpServletResponse resp) throws Exception {
         User user = JsonConverter.objectFromJson(req.getReader(), new User());
         Context.getPermissionsManager().checkUser(getUserId(req), user.getId());
-        Context.getDataManager().updateUser(user);
+        Context.getDataManager().updateUser(user, user.getPassword());
         sendResponse(resp.getWriter(), true);
     }