domi/forgejo-domi
1
0
Fork 0
forked from forgejo/forgejo
Code Pull requests Activity

[Refactor] Passwort Hash/Set (#14282)

Browse source 
* move SaltGeneration into HashPasswort and rename it to what it does

* Migration: Where Password is Valid with Empty String delete it

* prohibit empty password hash

* let SetPassword("") unset pwd stuff
This commit is contained in:
6543 2021-01-10 19:05:18 +01:00 • committed by GitHub
parent 6b3b6f1833
commit 74a0481586
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
10 changed files with 158 additions and 32 deletions
Download patch file Download diff file Expand all files Collapse all files

21
models/user_test.go
View file

@ -220,8 +220,7 @@ func TestEmailNotificationPreferences(t *testing.T) {
func TestHashPasswordDeterministic(t *testing.T) {
b := make([]byte, 16)
rand.Read(b)
u := &User{Salt: string(b)}
u := &User{}
algos := []string{"argon2", "pbkdf2", "scrypt", "bcrypt"}
for j := 0; j < len(algos); j++ {
u.PasswdHashAlgo = algos[j]
@ -231,19 +230,15 @@ func TestHashPasswordDeterministic(t *testing.T) {
pass := string(b)
// save the current password in the user - hash it and store the result
u.HashPassword(pass)
u.SetPassword(pass)
r1 := u.Passwd
// run again
u.HashPassword(pass)
u.SetPassword(pass)
r2 := u.Passwd
// assert equal (given the same salt+pass, the same result is produced) except bcrypt
if u.PasswdHashAlgo == "bcrypt" {
assert.NotEqual(t, r1, r2)
} else {
assert.Equal(t, r1, r2)
}
assert.NotEqual(t, r1, r2)
assert.True(t, u.ValidatePassword(pass))
}
}
}
@ -252,12 +247,10 @@ func BenchmarkHashPassword(b *testing.B) {
// BenchmarkHashPassword ensures that it takes a reasonable amount of time
// to hash a password - in order to protect from brute-force attacks.
pass := "password1337"
bs := make([]byte, 16)
rand.Read(bs)
u := &User{Salt: string(bs), Passwd: pass}
u := &User{Passwd: pass}
b.ResetTimer()
for i := 0; i < b.N; i++ {
u.HashPassword(pass)
u.SetPassword(pass)
}
}