hashed password support, and empty password security fix
This implements the previously documented hashed password support. While implementing that, I noticed a security hole, which this commit also fixes..master
parent
a436a064d2
commit
e943812dc9
|
@ -11,8 +11,70 @@ sub import { #{{{
|
||||||
call => \&formbuilder_setup);
|
call => \&formbuilder_setup);
|
||||||
hook(type => "formbuilder", id => "passwordauth",
|
hook(type => "formbuilder", id => "passwordauth",
|
||||||
call => \&formbuilder);
|
call => \&formbuilder);
|
||||||
|
hook(type => "sessioncgi", id => "passwordauth", call => \&sessioncgi);
|
||||||
} # }}}
|
} # }}}
|
||||||
|
|
||||||
|
# Checks if a string matches a user's password, and returns true or false.
|
||||||
|
sub checkpassword ($$;$) { #{{{
|
||||||
|
my $user=shift;
|
||||||
|
my $password=shift;
|
||||||
|
my $field=shift || "password";
|
||||||
|
|
||||||
|
# It's very important that the user not be allowed to log in with
|
||||||
|
# an empty password!
|
||||||
|
if (! length $password) {
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
my $userinfo=IkiWiki::userinfo_retrieve();
|
||||||
|
if (! length $user || ! defined $userinfo ||
|
||||||
|
! exists $userinfo->{$user} || ! ref $userinfo->{$user}) {
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
my $ret=0;
|
||||||
|
if (exists $userinfo->{$user}->{"crypt".$field}) {
|
||||||
|
eval q{use Authen::Passphrase};
|
||||||
|
error $@ if $@;
|
||||||
|
my $p = Authen::Passphrase->from_crypt($userinfo->{$user}->{"crypt".$field});
|
||||||
|
$ret=$p->match($password);
|
||||||
|
}
|
||||||
|
elsif (exists $userinfo->{$user}->{$field}) {
|
||||||
|
$ret=$password eq $userinfo->{$user}->{$field};
|
||||||
|
}
|
||||||
|
|
||||||
|
if ($ret &&
|
||||||
|
(exists $userinfo->{$user}->{resettoken} ||
|
||||||
|
exists $userinfo->{$user}->{cryptresettoken})) {
|
||||||
|
# Clear reset token since the user has successfully logged in.
|
||||||
|
delete $userinfo->{$user}->{resettoken};
|
||||||
|
delete $userinfo->{$user}->{cryptresettoken};
|
||||||
|
IkiWiki::userinfo_store($userinfo);
|
||||||
|
}
|
||||||
|
|
||||||
|
return $ret;
|
||||||
|
} #}}}
|
||||||
|
|
||||||
|
sub setpassword ($$;$) { #{{{
|
||||||
|
my $user=shift;
|
||||||
|
my $password=shift;
|
||||||
|
my $field=shift || "password";
|
||||||
|
|
||||||
|
eval q{use Authen::Passphrase::BlowfishCrypt};
|
||||||
|
if (! $@) {
|
||||||
|
my $p = Authen::Passphrase::BlowfishCrypt->new(
|
||||||
|
cost => $config{password_cost} || 8,
|
||||||
|
salt_random => 1,
|
||||||
|
passphrase => $password,
|
||||||
|
);
|
||||||
|
IkiWiki::userinfo_set($user, "crypt$field", $p->as_crypt);
|
||||||
|
IkiWiki::userinfo_set($user, $field, "");
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
IkiWiki::userinfo_set($user, $field, $password);
|
||||||
|
}
|
||||||
|
} #}}}
|
||||||
|
|
||||||
sub formbuilder_setup (@) { #{{{
|
sub formbuilder_setup (@) { #{{{
|
||||||
my %params=@_;
|
my %params=@_;
|
||||||
|
|
||||||
|
@ -50,7 +112,7 @@ sub formbuilder_setup (@) { #{{{
|
||||||
"Login" => [qw(name password)],
|
"Login" => [qw(name password)],
|
||||||
"Register" => [],
|
"Register" => [],
|
||||||
"Create Account" => [qw(name password confirm_password email)],
|
"Create Account" => [qw(name password confirm_password email)],
|
||||||
"Mail Password" => [qw(name)],
|
"Reset Password" => [qw(name)],
|
||||||
);
|
);
|
||||||
foreach my $opt (@{$required{$submittype}}) {
|
foreach my $opt (@{$required{$submittype}}) {
|
||||||
$form->field(name => $opt, required => 1);
|
$form->field(name => $opt, required => 1);
|
||||||
|
@ -75,14 +137,13 @@ sub formbuilder_setup (@) { #{{{
|
||||||
$form->field(
|
$form->field(
|
||||||
name => "password",
|
name => "password",
|
||||||
validate => sub {
|
validate => sub {
|
||||||
length $form->field("name") &&
|
checkpassword($form->field("name"), shift);
|
||||||
shift eq IkiWiki::userinfo_get($form->field("name"), 'password');
|
|
||||||
},
|
},
|
||||||
);
|
);
|
||||||
}
|
}
|
||||||
elsif ($submittype eq "Register" ||
|
elsif ($submittype eq "Register" ||
|
||||||
$submittype eq "Create Account" ||
|
$submittype eq "Create Account" ||
|
||||||
$submittype eq "Mail Password") {
|
$submittype eq "Reset Password") {
|
||||||
$form->field(name => "password", validate => 'VALUE');
|
$form->field(name => "password", validate => 'VALUE');
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -101,7 +162,7 @@ sub formbuilder_setup (@) { #{{{
|
||||||
);
|
);
|
||||||
}
|
}
|
||||||
elsif ($submittype eq "Login" ||
|
elsif ($submittype eq "Login" ||
|
||||||
$submittype eq "Mail Password") {
|
$submittype eq "Reset Password") {
|
||||||
$form->field(
|
$form->field(
|
||||||
name => "name",
|
name => "name",
|
||||||
validate => sub {
|
validate => sub {
|
||||||
|
@ -155,8 +216,8 @@ sub formbuilder (@) { #{{{
|
||||||
my $user_name=$form->field('name');
|
my $user_name=$form->field('name');
|
||||||
if (IkiWiki::userinfo_setall($user_name, {
|
if (IkiWiki::userinfo_setall($user_name, {
|
||||||
'email' => $form->field('email'),
|
'email' => $form->field('email'),
|
||||||
'password' => $form->field('password'),
|
|
||||||
'regdate' => time})) {
|
'regdate' => time})) {
|
||||||
|
setpassword($user_name, $form->field('password'));
|
||||||
$form->field(name => "confirm_password", type => "hidden");
|
$form->field(name => "confirm_password", type => "hidden");
|
||||||
$form->field(name => "email", type => "hidden");
|
$form->field(name => "email", type => "hidden");
|
||||||
$form->text(gettext("Account creation successful. Now you can Login."));
|
$form->text(gettext("Account creation successful. Now you can Login."));
|
||||||
|
@ -165,17 +226,35 @@ sub formbuilder (@) { #{{{
|
||||||
error(gettext("Error creating account."));
|
error(gettext("Error creating account."));
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
elsif ($form->submitted eq 'Mail Password') {
|
elsif ($form->submitted eq 'Reset Password') {
|
||||||
my $user_name=$form->field("name");
|
my $user_name=$form->field("name");
|
||||||
|
my $email=IkiWiki::userinfo_get($user_name, "email");
|
||||||
|
if (! length $email) {
|
||||||
|
error(gettext("No email address, so cannot email password reset instructions."));
|
||||||
|
}
|
||||||
|
|
||||||
|
# Store a token that can be used once
|
||||||
|
# to log the user in. This needs to be hard
|
||||||
|
# to guess. Generating a cgi session id will
|
||||||
|
# make it as hard to guess as any cgi session.
|
||||||
|
eval q{use CGI::Session};
|
||||||
|
error($@) if $@;
|
||||||
|
my $token = CGI::Session->new->id;
|
||||||
|
setpassword($user_name, $token, "resettoken");
|
||||||
|
|
||||||
my $template=template("passwordmail.tmpl");
|
my $template=template("passwordmail.tmpl");
|
||||||
$template->param(
|
$template->param(
|
||||||
user_name => $user_name,
|
user_name => $user_name,
|
||||||
user_password => IkiWiki::userinfo_get($user_name, "password"),
|
passwordurl => IkiWiki::cgiurl(
|
||||||
|
'do' => "reset",
|
||||||
|
'name' => $user_name,
|
||||||
|
'token' => $token,
|
||||||
|
),
|
||||||
wikiurl => $config{url},
|
wikiurl => $config{url},
|
||||||
wikiname => $config{wikiname},
|
wikiname => $config{wikiname},
|
||||||
REMOTE_ADDR => $ENV{REMOTE_ADDR},
|
REMOTE_ADDR => $ENV{REMOTE_ADDR},
|
||||||
);
|
);
|
||||||
|
|
||||||
eval q{use Mail::Sendmail};
|
eval q{use Mail::Sendmail};
|
||||||
error($@) if $@;
|
error($@) if $@;
|
||||||
sendmail(
|
sendmail(
|
||||||
|
@ -184,10 +263,10 @@ sub formbuilder (@) { #{{{
|
||||||
Subject => "$config{wikiname} information",
|
Subject => "$config{wikiname} information",
|
||||||
Message => $template->output,
|
Message => $template->output,
|
||||||
) or error(gettext("Failed to send mail"));
|
) or error(gettext("Failed to send mail"));
|
||||||
|
|
||||||
$form->text(gettext("Your password has been emailed to you."));
|
$form->text(gettext("You have been mailed password reset instructions."));
|
||||||
$form->field(name => "name", required => 0);
|
$form->field(name => "name", required => 0);
|
||||||
push @$buttons, "Mail Password";
|
push @$buttons, "Reset Password";
|
||||||
}
|
}
|
||||||
elsif ($form->submitted eq "Register") {
|
elsif ($form->submitted eq "Register") {
|
||||||
@$buttons="Create Account";
|
@$buttons="Create Account";
|
||||||
|
@ -197,20 +276,39 @@ sub formbuilder (@) { #{{{
|
||||||
@$buttons="Create Account";
|
@$buttons="Create Account";
|
||||||
}
|
}
|
||||||
else {
|
else {
|
||||||
push @$buttons, "Register", "Mail Password";
|
push @$buttons, "Register", "Reset Password";
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
elsif ($form->title eq "preferences") {
|
elsif ($form->title eq "preferences") {
|
||||||
if ($form->submitted eq "Save Preferences" && $form->validate) {
|
if ($form->submitted eq "Save Preferences" && $form->validate) {
|
||||||
my $user_name=$form->field('name');
|
my $user_name=$form->field('name');
|
||||||
foreach my $field (qw(password)) {
|
if ($form->field("password") && length $form->field("password")) {
|
||||||
if (defined $form->field($field) && length $form->field($field)) {
|
setpassword($user_name, $form->field('password'));
|
||||||
IkiWiki::userinfo_set($user_name, $field, $form->field($field)) ||
|
}
|
||||||
error("failed to set $field");
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
} #}}}
|
} #}}}
|
||||||
|
|
||||||
|
sub sessioncgi ($$) { #{{{
|
||||||
|
my $q=shift;
|
||||||
|
my $session=shift;
|
||||||
|
|
||||||
|
if ($q->param('do') eq 'reset') {
|
||||||
|
my $name=$q->param("name");
|
||||||
|
my $token=$q->param("token");
|
||||||
|
|
||||||
|
if (! defined $name || ! defined $token ||
|
||||||
|
! length $name || ! length $token) {
|
||||||
|
error(gettext("incorrect password reset url"));
|
||||||
|
}
|
||||||
|
if (! checkpassword($name, $token, "resettoken")) {
|
||||||
|
error(gettext("password reset denied"));
|
||||||
|
}
|
||||||
|
|
||||||
|
$session->param("name", $name);
|
||||||
|
IkiWiki::cgi_prefs($q, $session);
|
||||||
|
exit;
|
||||||
|
}
|
||||||
|
} #}}}
|
||||||
|
|
||||||
1
|
1
|
||||||
|
|
|
@ -1,5 +1,8 @@
|
||||||
ikiwiki (2.48) UNRELEASED; urgency=low
|
ikiwiki (2.48) UNRELEASED; urgency=high
|
||||||
|
|
||||||
|
* Fix security hole that occurred if openid and passwordauth were both
|
||||||
|
enabled. passwordauth would allow logging in as a known openid, with an
|
||||||
|
empty password.
|
||||||
* Add rel=nofollow to edit links. This may prevent some spiders from
|
* Add rel=nofollow to edit links. This may prevent some spiders from
|
||||||
pounding on the cgi following edit links.
|
pounding on the cgi following edit links.
|
||||||
* When calling decode_utf8 on known-problimatic content in aggregate,
|
* When calling decode_utf8 on known-problimatic content in aggregate,
|
||||||
|
@ -8,12 +11,9 @@ ikiwiki (2.48) UNRELEASED; urgency=low
|
||||||
saying it is the default.
|
saying it is the default.
|
||||||
* passwordauth: If Authen::Passphrase is installed, use it to store
|
* passwordauth: If Authen::Passphrase is installed, use it to store
|
||||||
password hashes, crypted with Eksblowfish.
|
password hashes, crypted with Eksblowfish.
|
||||||
* Existing cleartext passwords in the userdb will be automatically hashed
|
* `ikiwiki-transiition hashpassword /path/to/srcdir` can be used to
|
||||||
(if Authen::Passphrase is installed) the next time a user logs in.
|
hash existing plaintext passwords.
|
||||||
Or `ikiwiki-transition hashpassword /path/to/srcdir` can be used to force
|
* Passwords will no longer be mailed, but instead a password reset link.
|
||||||
a conversion.
|
|
||||||
* Passwords will no longer be mailed, but instead a password reset link
|
|
||||||
mailed.
|
|
||||||
* The password_cost config setting is provided as a "more security" knob.
|
* The password_cost config setting is provided as a "more security" knob.
|
||||||
* teximg: Fix logurl.
|
* teximg: Fix logurl.
|
||||||
* teximg: If the log isn't written, avoid ugly error messages.
|
* teximg: If the log isn't written, avoid ugly error messages.
|
||||||
|
|
|
@ -13,7 +13,7 @@ located in /usr/share/ikiwiki/templates by default.
|
||||||
* `editpage.tmpl` - Create/edit page.
|
* `editpage.tmpl` - Create/edit page.
|
||||||
* `change.tmpl` - Used to create a page describing a change made to the wiki.
|
* `change.tmpl` - Used to create a page describing a change made to the wiki.
|
||||||
* `passwordmail.tmpl` - Not a html template, this is used to
|
* `passwordmail.tmpl` - Not a html template, this is used to
|
||||||
generate the mail with the user's password in it.
|
generate a mail with an url the user can use to reset their password.
|
||||||
* `rsspage.tmpl` - Used for generating rss feeds for [[blogs|ikiwiki/blog]].
|
* `rsspage.tmpl` - Used for generating rss feeds for [[blogs|ikiwiki/blog]].
|
||||||
* `rssitem.tmpl` - Used for generating individual items on rss feeds.
|
* `rssitem.tmpl` - Used for generating individual items on rss feeds.
|
||||||
* `atompage.tmpl` - Used for generating atom feeds for blogs.
|
* `atompage.tmpl` - Used for generating atom feeds for blogs.
|
||||||
|
|
|
@ -57,6 +57,8 @@ sub indexdb {
|
||||||
usage();
|
usage();
|
||||||
}
|
}
|
||||||
|
|
||||||
|
# Note: No lockwiki here because ikiwiki already locks it
|
||||||
|
# before calling this.
|
||||||
if (! IkiWiki::oldloadindex()) {
|
if (! IkiWiki::oldloadindex()) {
|
||||||
die "failed to load index\n";
|
die "failed to load index\n";
|
||||||
}
|
}
|
||||||
|
@ -71,11 +73,38 @@ sub indexdb {
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
sub hashpassword {
|
||||||
|
$config{wikistatedir}=shift()."/.ikiwiki";
|
||||||
|
|
||||||
|
if (! defined $config{wikistatedir}) {
|
||||||
|
usage();
|
||||||
|
}
|
||||||
|
|
||||||
|
eval q{use IkiWiki::UserInfo};
|
||||||
|
eval q{use Authen::Passphrase::BlowfishCrypt};
|
||||||
|
if ($@) {
|
||||||
|
error("ikiwiki-transition hashpassword: failed to load Authen::Passphrase, passwords not hashed");
|
||||||
|
}
|
||||||
|
|
||||||
|
IkiWiki::lockwiki();
|
||||||
|
IkiWiki::loadplugin("passwordauth");
|
||||||
|
my $userinfo = IkiWiki::userinfo_retrieve();
|
||||||
|
foreach my $user (keys %{$userinfo}) {
|
||||||
|
if (ref $userinfo->{$user} &&
|
||||||
|
exists $userinfo->{$user}->{password} &&
|
||||||
|
length $userinfo->{$user}->{password} &&
|
||||||
|
! exists $userinfo->{$user}->{cryptpassword}) {
|
||||||
|
IkiWiki::Plugin::passwordauth::setpassword($user, $userinfo->{$user}->{password});
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
sub usage {
|
sub usage {
|
||||||
print STDERR "Usage: ikiwiki-transition type ...\n";
|
print STDERR "Usage: ikiwiki-transition type ...\n";
|
||||||
print STDERR "Currently supported transition subcommands:\n";
|
print STDERR "Currently supported transition subcommands:\n";
|
||||||
print STDERR " prefix_directives file\n";
|
print STDERR " prefix_directives file\n";
|
||||||
print STDERR " indexdb srcdir\n";
|
print STDERR " indexdb srcdir\n";
|
||||||
|
print STDERR " hashpassword srcdir\n";
|
||||||
exit 1;
|
exit 1;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -85,6 +114,9 @@ my $mode=shift;
|
||||||
if ($mode eq 'prefix_directives') {
|
if ($mode eq 'prefix_directives') {
|
||||||
prefix_directives(@ARGV);
|
prefix_directives(@ARGV);
|
||||||
}
|
}
|
||||||
|
if ($mode eq 'hashpassword') {
|
||||||
|
hashpassword(@ARGV);
|
||||||
|
}
|
||||||
elsif ($mode eq 'indexdb') {
|
elsif ($mode eq 'indexdb') {
|
||||||
indexdb(@ARGV);
|
indexdb(@ARGV);
|
||||||
}
|
}
|
||||||
|
|
|
@ -8,7 +8,7 @@ msgid ""
|
||||||
msgstr ""
|
msgstr ""
|
||||||
"Project-Id-Version: PACKAGE VERSION\n"
|
"Project-Id-Version: PACKAGE VERSION\n"
|
||||||
"Report-Msgid-Bugs-To: \n"
|
"Report-Msgid-Bugs-To: \n"
|
||||||
"POT-Creation-Date: 2008-05-25 14:26-0400\n"
|
"POT-Creation-Date: 2008-05-30 16:47-0400\n"
|
||||||
"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
|
"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
|
||||||
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
|
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
|
||||||
"Language-Team: LANGUAGE <LL@li.org>\n"
|
"Language-Team: LANGUAGE <LL@li.org>\n"
|
||||||
|
@ -325,20 +325,28 @@ msgstr ""
|
||||||
msgid "bad or missing template"
|
msgid "bad or missing template"
|
||||||
msgstr ""
|
msgstr ""
|
||||||
|
|
||||||
#: ../IkiWiki/Plugin/passwordauth.pm:162
|
#: ../IkiWiki/Plugin/passwordauth.pm:223
|
||||||
msgid "Account creation successful. Now you can Login."
|
msgid "Account creation successful. Now you can Login."
|
||||||
msgstr ""
|
msgstr ""
|
||||||
|
|
||||||
#: ../IkiWiki/Plugin/passwordauth.pm:165
|
#: ../IkiWiki/Plugin/passwordauth.pm:226
|
||||||
msgid "Error creating account."
|
msgid "Error creating account."
|
||||||
msgstr ""
|
msgstr ""
|
||||||
|
|
||||||
#: ../IkiWiki/Plugin/passwordauth.pm:186
|
#: ../IkiWiki/Plugin/passwordauth.pm:261
|
||||||
msgid "Failed to send mail"
|
msgid "Failed to send mail"
|
||||||
msgstr ""
|
msgstr ""
|
||||||
|
|
||||||
#: ../IkiWiki/Plugin/passwordauth.pm:188
|
#: ../IkiWiki/Plugin/passwordauth.pm:263
|
||||||
msgid "Your password has been emailed to you."
|
msgid "You have been mailed password reset instructions."
|
||||||
|
msgstr ""
|
||||||
|
|
||||||
|
#: ../IkiWiki/Plugin/passwordauth.pm:301
|
||||||
|
msgid "incorrect password reset url"
|
||||||
|
msgstr ""
|
||||||
|
|
||||||
|
#: ../IkiWiki/Plugin/passwordauth.pm:304
|
||||||
|
msgid "password reset denied"
|
||||||
msgstr ""
|
msgstr ""
|
||||||
|
|
||||||
#: ../IkiWiki/Plugin/pingee.pm:21
|
#: ../IkiWiki/Plugin/pingee.pm:21
|
||||||
|
|
|
@ -1,10 +1,15 @@
|
||||||
Someone[1], possibly you, requested that you be emailed the password for user
|
Someone[1], possibly you, requested that the password for
|
||||||
<TMPL_VAR USER_NAME> on <TMPL_VAR WIKINAME>[2].
|
<TMPL_VAR USER_NAME> on <TMPL_VAR WIKINAME>[2] be reset.
|
||||||
|
|
||||||
The password is: <TMPL_VAR USER_PASSWORD>
|
To change your password, visit the following url, and enter a new password:
|
||||||
|
|
||||||
|
<TMPL_VAR PASSWORDURL>
|
||||||
|
|
||||||
|
This url can only be used once to change your password, and it will also
|
||||||
|
stop working the next time you successfully log in.
|
||||||
|
|
||||||
--
|
--
|
||||||
ikiwiki
|
ikiwiki
|
||||||
|
|
||||||
[1] The user requesting the password was at IP address <TMPL_VAR REMOTE_ADDR>
|
[1] The IP address was <TMPL_VAR REMOTE_ADDR>
|
||||||
[2] Located at <TMPL_VAR WIKIURL>
|
[2] Located at <TMPL_VAR WIKIURL>
|
||||||
|
|
Loading…
Reference in New Issue