bradymiller/openemr — comment on commit 552af939c91a0a259635adb194be64e553565922
File:  line 0
By yehster:

I pulled this commit and it seems to be working... Just reviewing the code in general to see how this is used.

It looks like the only reference to validateUser.php is an ajax call made by login.php. The browser uses validateUser to determine if the user's password is stored on the server as MD5 or SHA1.

If it's SHA1, this is the "normal case" and the password is just passed along, If it's MD5, then password is hashed to both MD5 and SHA1 and passed in 2 post variables.