Move to stronger password hash #2401

TheAspens · 2018-03-08T21:59:09Z

These changes will close issue #2353 and close issue #1644.

https://github.com/ircmaxell/password_compat

change password, login)

TheAspens · 2018-03-09T21:19:44Z

@drshawnkwang and @tristanolive - can the two of you please review this pull request and see if anything needs to be changed in the Drupal code?

TheAspens · 2018-03-09T22:03:29Z

@davidpanderson - can you please review this as well but if you are ok with it, please don't merge until either @drshawnkwang and @tristanolive have chimed in.

TheAspens · 2018-03-09T22:31:33Z

Also @brevilo and @nicolas17 - since you guys reveiwed the original design - do you guys want to review the implementation real quick?

brevilo · 2018-03-12T08:44:42Z

FYI, as I added myself as a reviewer David got dropped for an unknown reason, hence I added him back.

brevilo

A general note: please try to stick to one format/style for arguments lists. That is, where you use spaces around arguments, operators and commas. Ideally use a formatter with your preferred style rules, preferably matching (or closely following) BOINC's. Thanks.

brevilo · 2018-03-12T09:16:01Z

html/ops/login_action.php

+function do_passwd_rehash($user,$passwd_hash) {
+    $database_passwd_hash = password_hash($passwd_hash , PASSWORD_DEFAULT);
+    $result = $user->update(
+        "passwd_hash='$database_passwd_hash'"


Here you escape the password hash before its use as part of an SQL clause. If you think it's required, it should be done here as well.

After reviewing, the hash does not need to be escaped so I have removed it from the referenced line.

brevilo · 2018-03-12T09:16:25Z

html/user/am_set_info.php

@@ -176,7 +177,8 @@ function success($x) {
    $query .= " email_addr='$email_addr', ";
 }
 if ($password_hash) {
-    $query .= " passwd_hash='$password_hash', ";
+    $database_passwd_hash = password_hash($password_hash , PASSWORD_DEFAULT);
+    $query .= " passwd_hash='$database_passwd_hash', ";
 }


Here you escape the password hash before its use as part of an SQL clause. If you think it's required, it should be done here as well.

After reviewing, the hash does not need to be escaped so I have removed it from the referenced line.

brevilo · 2018-03-12T09:17:44Z

html/user/edit_email_action.php

            $email_addr = BoincDb::escape_string($email_addr);
            $result = $user->update(
-                "email_addr='$email_addr', passwd_hash='$passwd_hash', email_validated=0"
+                "email_addr='$email_addr', passwd_hash='$database_passwd_hash', email_validated=0"


Here you escape the password hash before its use as part of an SQL clause. If you think it's required, it should be done here as well.

After reviewing, the hash does not need to be escaped so I have removed it from the referenced line.

brevilo · 2018-03-12T09:17:55Z

html/user/edit_passwd_action.php

@@ -45,7 +46,8 @@
 }

 $passwd_hash = md5($passwd.$user->email_addr);
-$result = $user->update("passwd_hash='$passwd_hash'");
+$database_passwd_hash = password_hash( $passwd_hash, PASSWORD_DEFAULT);
+$result = $user->update("passwd_hash='$database_passwd_hash'");


Here you escape the password hash before its use as part of an SQL clause. If you think it's required, it should be done here as well.

After reviewing, the hash does not need to be escaped so I have removed it from the referenced line.

brevilo · 2018-03-12T09:18:09Z

html/user/login_action.php

+function do_passwd_rehash($user,$passwd_hash) {
+    $database_passwd_hash = password_hash($passwd_hash , PASSWORD_DEFAULT);
+    $result = $user->update(
+        "passwd_hash='$database_passwd_hash'"


Here you escape the password hash before its use as part of an SQL clause. If you think it's required, it should be done here as well.

After reviewing, the hash does not need to be escaped so I have removed it from the referenced line.

brevilo · 2018-03-12T09:19:38Z

html/user/login_action.php

@@ -49,9 +57,19 @@ function login_with_email($email_addr, $passwd, $next_url, $perm) {
        error_page("This account has been administratively disabled.");
    }
    // allow authenticator as password
-    if ($passwd != $user->authenticator) {
+    if ($passwd != $user->authenticator ) {


Why the added space? It's inconsistent.

brevilo · 2018-03-12T09:22:02Z

html/user/lookup_account.php

+function do_passwd_rehash($user,$passwd_hash) {
+    $database_passwd_hash = password_hash($passwd_hash , PASSWORD_DEFAULT);
+    $result = $user->update(
+        "passwd_hash='$database_passwd_hash'"


Here you escape the password hash before its use as part of an SQL clause. If you think it's required, it should be done here as well.

After reviewing, the hash does not need to be escaped so I have removed it from the referenced line.

brevilo · 2018-03-12T09:24:35Z

html/user/lookup_account.php

@@ -72,16 +80,28 @@
    // if no password set, set password to account key
    //
    if (!strlen($user->passwd_hash)) {
-        $user->passwd_hash = $auth_hash;
+        $user->passwd_hash = password_hash($auth_hash , PASSWORD_DEFAULT);
        $user->update("passwd_hash='$user->passwd_hash'");


Here you escape the password hash before its use as part of an SQL clause. If you think it's required, it should be done here as well.

After reviewing, the hash does not need to be escaped so I have removed it from the referenced line.

it into the database

TheAspens · 2018-03-13T21:51:15Z

I fixed the style issues. Please let me know if you have any other feedback on the change. Thanks!

drshawnkwang · 2018-03-13T22:04:48Z

I looked at the code and checked-out your branch to test it on my Drupal devel. system. My testing shows that there shouldn't be any serious inconsistency with your PR and the drupal codebase. But we should also see if Tristan has any comments. Additionally, we'll work independently to put similar code into the drupal codebase.

tristanolive · 2018-03-14T02:25:13Z

I'd expect some problems to arise with RPCs on the Drupal side, as some were implemented as simple wrappers around BOINC RPCs and others were a bit more involved. In particular, the create_account implementation in Drupal will likely need your changes integrated into it.

As Shawn's tests show, though, there doesn't look to be anything major.

brevilo

Thanks!

tristanolive · 2018-03-20T20:34:59Z

Update for clarity: This PR can go ahead without waiting for corresponding Drupal updates (which should follow before too long).

TheAspens · 2018-03-22T14:21:51Z

@tristanolive - thanks for the clarification. Since I added you as a reviewer can you either approve or remove yourself as a reviewer? Thanks!

@davidpanderson - this touches enough stuff that I would appreciate your review on this - and if you are ok with it, please go ahead and merge it. Thanks!

drshawnkwang · 2018-04-03T20:08:05Z

I know this PR has 'pass review', but would it be possible to make two minor late changes:

function do_passwd_rehash() - could this be moved into an .inc file, such as user_util, this way the Drupal-BOINC code could load the library and I can use this function?
The file html/inc/password.php - could it be renamed html/inc/password.inc ? This would be make it consistent with the other libraries in that directory. The Drupal code selectively loads .inc files for use as libraries. We would want to require_once this file as you have.

Maybe do_passwd_rehash() could be moved into the password.inc library?

TheAspens · 2018-04-03T22:20:49Z

@drshawnkwang - yes - I can make those. I'm updating this to WIP while I make those changes.

scripts

…as a .inc file and to move common functions into user_util.inc

TheAspens · 2018-04-04T18:51:38Z

@drshawnkwang - please review again and let me know if this matches what you suggested and work for you. Thanks for the feedback.

drshawnkwang · 2018-04-04T20:23:32Z

@TheAspens , thanks for the changes. I checked out this branch and was able to load the password_compat.inc and user_util.inc libraries in order to use the functions you wrote. Thanks again for making these changes.

TheAspens · 2018-04-09T19:30:51Z

I just found this #1644. Which will also be closed by this change.

TheAspens · 2018-04-13T22:38:49Z

@drshawnkwang @brevilo @tristanolive @davidpanderson - This has been open long enough for any objections to be raised and so it should be good to merge. Can someone go ahead and merge this? Thanks!

brevilo · 2018-04-16T11:24:04Z

@davidpanderson hasn't signed-off yet so he should do the merge as soon as he's ok with it.

davidpanderson · 2018-04-16T20:34:16Z

This looks fine, but it conflicts with the token PR. Kevin, feel free to merge after resolving that.

Conflicts: py/Boinc/setup_project.py

TheAspens · 2018-04-17T13:38:16Z

Ok - I've fixed the merge conflict. Everyone has approved this pull request so if someone can merge it I would appreciate it! (by the rules, I cannot merge my own).

Kevin Reed added 5 commits March 8, 2018 15:37

web: Add password compatability library (MIT License) from

5809474

https://github.com/ircmaxell/password_compat

web: initial changes for improving password hashing (join, change email,

4b147e6

change password, login)

web: Only rehash password on login when needed

09a3666

web: Fix autofocus and tab order for the login form

cfa5cd6

web: changes for improving password hashing (admin, web_rpcs)

2f29996

TheAspens changed the title ~~WIP: Move to stronger password hash~~ Move to stronger password hash Mar 9, 2018

TheAspens changed the title ~~Move to stronger password hash~~ [WIP] Move to stronger password hash Mar 9, 2018

TheAspens changed the title ~~[WIP] Move to stronger password hash~~ Move to stronger password hash Mar 9, 2018

brevilo requested review from brevilo and davidpanderson March 12, 2018 08:43

brevilo reviewed Mar 12, 2018

View reviewed changes

TheAspens requested a review from tristanolive March 13, 2018 12:56

Kevin Reed added 2 commits March 13, 2018 16:23

web: Once hashed a password does not need to be escaped when inserting

ea6f2c3

it into the database

web: Fix style incompatibilities

1ceb1e3

brevilo approved these changes Mar 15, 2018

View reviewed changes

tristanolive approved these changes Mar 22, 2018

View reviewed changes

Merge branch 'master' into knr_passwd_hash

e48bb4a

TheAspens changed the title ~~Move to stronger password hash~~ [WIP] Move to stronger password hash Apr 3, 2018

Merge branch 'master' into knr_passwd_hash

df64472

Kevin Reed added 2 commits April 4, 2018 13:46

Add the password compatability library to the create project setup

333e5c4

scripts

web: refactor password hashing changes to move compatibility library …

78f96d2

…as a .inc file and to move common functions into user_util.inc

TheAspens changed the title ~~[WIP] Move to stronger password hash~~ Move to stronger password hash Apr 4, 2018

Merge branch 'master' into knr_passwd_hash

fbd7447

Conflicts: py/Boinc/setup_project.py

davidpanderson merged commit ad28e83 into master Apr 17, 2018

TheAspens deleted the knr_passwd_hash branch April 17, 2018 19:52

marius311 mentioned this pull request Oct 12, 2018

Should switch from md5sum to sha256sum #1346

Closed

Move to stronger password hash #2401

Move to stronger password hash #2401

Conversation

TheAspens commented Mar 8, 2018 • edited Loading

TheAspens commented Mar 9, 2018 • edited Loading

TheAspens commented Mar 9, 2018

TheAspens commented Mar 9, 2018

brevilo commented Mar 12, 2018

brevilo left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

TheAspens commented Mar 13, 2018

drshawnkwang commented Mar 13, 2018

tristanolive commented Mar 14, 2018

brevilo left a comment

Choose a reason for hiding this comment

tristanolive commented Mar 20, 2018

TheAspens commented Mar 22, 2018

drshawnkwang commented Apr 3, 2018 • edited Loading

TheAspens commented Apr 3, 2018

TheAspens commented Apr 4, 2018

drshawnkwang commented Apr 4, 2018 • edited Loading

TheAspens commented Apr 9, 2018

TheAspens commented Apr 13, 2018

brevilo commented Apr 16, 2018

davidpanderson commented Apr 16, 2018

TheAspens commented Apr 17, 2018

TheAspens commented Mar 8, 2018 •

edited

Loading

TheAspens commented Mar 9, 2018 •

edited

Loading

drshawnkwang commented Apr 3, 2018 •

edited

Loading

drshawnkwang commented Apr 4, 2018 •

edited

Loading