Added automatic password hashing upgrade.
Ylian Saint-Hilaire committed
Nov 2, 2017 at 18:53 UTC
0efc531558f6e566f4a680bae3f00b8df3fd7228
1 file changed
+10
-8
webserver.js
+10
-8
@@ -42,8 +42,6 @@ module.exports.CreateWebServer = function (parent, db, args, secret, certificate
42
obj.net = require('net');
43
obj.tls = require('tls');
44
obj.path = require('path');
45
- obj.hash = require('./pass').hash;
46
- obj.hash2 = require('./pass').hash2;
45
obj.constants = require('constants');
46
obj.bodyParser = require('body-parser');
47
obj.session = require('express-session');
@@ -178,14 +176,18 @@ module.exports.CreateWebServer = function (parent, db, args, secret, certificate
176
} else {
177
if (user.passtype != null) {
178
// IIS default clear or weak password hashing (SHA-1)
181
- obj.iishash(user.passtype, pass, user.salt, function (err, hash) {
179
+ require('./pass').iishash(user.passtype, pass, user.salt, function (err, hash) {
180
if (err) return fn(err);
183
- if (hash == user.hash) return fn(null, user._id);
181
+ if (hash == user.hash) {
182
+ // Update the password to the stronger format.
183
+ require('./pass').hash(pass, function (err, salt, hash) { if (err) throw err; user.salt = salt; user.hash = hash; delete user.passtype; obj.db.SetUser(user); });
184
+ return fn(null, user._id);
185
+ }
186
fn(new Error('invalid password'), null, user.passhint);
187
});
188
} else {
187
- // Default strong password hashing
188
- obj.hash(pass, user.salt, function (err, hash) {
189
+ // Default strong password hashing (pbkdf2 SHA384)
190
+ require('./pass').hash(pass, user.salt, function (err, hash) {
191
if (err) return fn(err);
192
if (hash == user.hash) return fn(null, user._id);
193
fn(new Error('invalid password'), null, user.passhint);
@@ -341,7 +343,7 @@ module.exports.CreateWebServer = function (parent, db, args, secret, certificate
343
req.session.userid = user._id;
344
req.session.domainid = domain.id;
345
// Create a user, generate a salt and hash the password
344
- obj.hash(req.body.password1, function (err, salt, hash) {
346
+ require('./pass').hash(req.body.password1, function (err, salt, hash) {
347
if (err) throw err;
348
user.salt = salt;
349
user.hash = hash;
@@ -383,7 +385,7 @@ module.exports.CreateWebServer = function (parent, db, args, secret, certificate
385
if (!req.session || !req.session.userid || !req.body.apassword1 || (req.body.apassword1 != req.body.apassword2) || (req.session.domainid != domain.id)) { res.redirect(domain.url); return; }
386
387
// Update the password
386
- obj.hash(req.body.apassword1, function (err, salt, hash) {
388
+ require('./pass').hash(req.body.apassword1, function (err, salt, hash) {
389
if (err) throw err;
390
var hint = req.body.apasswordhint;
391
if (hint.length > 250) hint = hint.substring(0, 250);