Backup_Repos/filestash
1
0
Fork 0
mirror of https://github.com/mickael-kerjean/filestash synced 2025-12-06 08:22:24 +01:00
Code Issues Projects Releases Wiki Activity

fix (htpasswd): hash acceptance rules - #821

Browse source 
For htpasswd entries where hash is an actual valid hash (SHA etc.), the hash
itself should not be accepted as password. Otherwise, obtaining the htpasswd
file gives an attacker access to all accounts withoutneeding to crack/reverse
hashes.

This commit tries to ensure that hash==password is only accepted if hash is
not a valid hash (plaintext password fallback).
This commit is contained in:
Tobias Kaiser 2025-06-30 04:18:37 +02:00 committed by GitHub
parent e3f910814a
commit 45432e1f32
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 7 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
server/plugin/plg_authenticate_htpasswd/index.go
View file

@ -122,10 +122,7 @@ func (this Htpasswd) Callback(formData map[string]string, idpParams map[string]s
}
func verifyPassword(password string, hash string, _user string) bool {
if password == hash {
Log.Warning("plg_authenticate_htpasswd password for user '%s' isn't stored in a secure way, you should hash your password using something like 'openssl passwd -6'", _user)
return true
} else if strings.HasPrefix(hash, "{SHA}") {
if strings.HasPrefix(hash, "{SHA}") {
d := sha1.New()
d.Write([]byte(password))
return subtle.ConstantTimeCompare(
@ -136,7 +133,12 @@ func verifyPassword(password string, hash string, _user string) bool {
var c crypt.Crypter
parts := strings.SplitN(hash, "$", 4)
if len(parts) != 4 {
return false
if password == hash {
Log.Warning("plg_authenticate_htpasswd password for user '%s' isn't stored in a secure way, you should hash your password using something like 'openssl passwd -6'", _user)
return true
} else {
return false
}
}
if strings.HasPrefix(hash, "$apr1$") {
c = apr1_crypt.New()