nik/FreedomBox
1
0
Fork 0
mirror of https://github.com/freedombox/FreedomBox.git synced 2026-01-28 08:03:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

Use bcrypt to hash passwords for new users in firstboot and user_add forms. Removed references to md5 hashing which was already non-functional.

Browse Source
This commit is contained in:
James Valleroy 2013-11-03 21:55:06 +00:00 committed by Nick Daly
parent 41e46d53b5
commit c4b2fb1a60
2 changed files with 23 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
modules/installed/first_boot.py
View File

@ -9,7 +9,7 @@ from withsqlite.withsqlite import sqlite_db
import cfg
import config
from model import User
import md5
from passlib.hash import bcrypt
class FirstBoot(PagePlugin):
def __init__(self, *args, **kwargs):
@ -65,16 +65,14 @@ class FirstBoot(PagePlugin):
box_key = self.generate_box_key()
db['box_key'] = box_key
if username and password:
# FIXME: MD5 as a password hash? REALLY?! NOOO!!!
passphrase = md5.new()
passphrase.update(password)
pass_hash = bcrypt.encrypt(password)
di = {
'username':username,
'name': 'First user - please change',
'expert': 'on',
"groups": ["expert"],
'passphrase': passphrase.digest(),
'passphrase':pass_hash,
'salt':pass_hash[7:29], # for bcrypt
}
new_user = User(di)
cfg.users.set(username,new_user)

32
modules/installed/system/users.py
View File

@ -6,6 +6,7 @@ import cfg
from forms import Form
from util import *
from model import User
from passlib.hash import bcrypt
class users(PagePlugin):
order = 20 # order of running init in PagePlugins
@ -32,30 +33,35 @@ class add(FormPlugin, PagePlugin):
don't worry about it.</p>""")
def main(self, username='', name='', email='', message=None, *args, **kwargs):
form = Form(title="Add User",
action=cfg.server_dir + "/sys/users/add/index",
onsubmit="return md5ify('add_user_form', 'password')",
form = Form(title="Add User",
action=cfg.server_dir + "/sys/users/add/index",
name="add_user_form",
message=message)
form.text_input(_("Username"), name="username", value=username)
form.text_input(_("Full name"), name="name", value=name)
form.text_input(_("Email"), name="email", value=email)
form.text_input(_("Password"), name="password", type="password")
form.text_input(name="md5_password", type="hidden")
form.submit(label=_("Create User"), name="create")
return form.render()
def process_form(self, username=None, name=None, email=None, md5_password=None, **kwargs):
def process_form(self, username=None, name=None, email=None, password=None, **kwargs):
msg = Message()
if not username: msg.add = _("Must specify a username!")
if not md5_password: msg.add = _("Must specify a password!")
if not password: msg.add = _("Must specify a password!")
if username in cfg.users.get_all():
msg.add = _("User already exists!")
else:
try:
di = {'username':username, 'name':name, 'email':email, 'passphrase':md5_password}
pass_hash = bcrypt.encrypt(password)
di = {
'username':username,
'name':name,
'email':email,
'passphrase':pass_hash,
'salt': pass_hash[7:29], # for bcrypt
}
new_user = User(di)
cfg.users.set(username,new_user)
except:
@ -70,7 +76,7 @@ class add(FormPlugin, PagePlugin):
class edit(FormPlugin, PagePlugin):
url = ["/sys/users/edit"]
order = 35
sidebar_left = ''
sidebar_right = _("""<strong>Edit Users</strong><p>Click on a user's name to
go to a screen for editing that user's account.</p><strong>Delete
@ -84,9 +90,9 @@ class edit(FormPlugin, PagePlugin):
add_form.html('<span class="indent"><strong>Delete</strong><br /></span>')
for uname in users:
user = User(uname[1])
add_form.html('<span class="indent">&nbsp;&nbsp;%s&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;' %
add_form.html('<span class="indent">&nbsp;&nbsp;%s&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;' %
add_form.get_checkbox(name=user['username']) +
'<a href="/sys/users/edit?username=%s">%s (%s)</a><br /></span>' %
'<a href="/sys/users/edit?username=%s">%s (%s)</a><br /></span>' %
(user['username'], user['name'], user['username']))
add_form.submit(label=_("Delete User"), name="delete")
return add_form.render()
@ -123,9 +129,9 @@ class edit(FormPlugin, PagePlugin):
u = cfg.users[kwargs['username']]
if not u:
main = _("<p>Could not find a user with username of %s!</p>" % kwargs['username'])
return self.fill_template(template="err", title=_("Unnown User"), main=main,
return self.fill_template(template="err", title=_("Unnown User"), main=main,
sidebar_left=self.sidebar_left, sidebar_right=sidebar_right)
main = _("""<strong>Edit User '%s'</strong>""" % u['username'])
sidebar_right = ''
return self.fill_template(title="Manage Users and Groups", main=main, sidebar_left=self.sidebar_left, sidebar_right=sidebar_right)