Do not override the passwd string. First it prevents the md5 working if the crypt() check fails and also is useless to override it since the parameter is passed by value and not by reference.

1 files changed, 2 insertions, 4 deletions

diff --git a/etc/inc/auth.inc b/etc/inc/auth.inc
index a125741..ceaa9e5 100644
--- a/etc/inc/auth.inc
+++ b/etc/inc/auth.inc
@@ -302,15 +302,13 @@ function local_backed($username, $passwd) {
 
 	if ($user['password'])
 	{
-		$passwd = crypt($passwd, $user['password']);
-		if ($passwd == $user['password'])
+		if (crypt($passwd, $user['password']) == $user['password'])
 			return true;
 	}
 
 	if ($user['md5-hash'])
 	{
-		$passwd = md5($passwd);
-		if ($passwd == $user['md5-hash'])
+		if (md5($passwd) == $user['md5-hash'])
 			return true;
 	}