623c93ff46
- The current implementation of `RandomString` doesn't give you a most-possible unique randomness. It gives you 6*`length` instead of the possible 8*`length` bits(or as `length`x bytes) randomness. This is because `RandomString` is being limited to a max value of 63, this in order to represent the random byte as a letter/digit.
- The recommendation of pbkdf2 is to use 64+ bit salt, which the `RandomString` doesn't give with a length of 10, instead of increasing 10 to a higher number, this patch adds a new function called `RandomBytes` which does give you the guarentee of 8*`length` randomness and thus corresponding of `length`x bytes randomness.
- Use hexadecimal to store the bytes value in the database, as mentioned, it doesn't play nice in order to convert it to a string. This will always be a length of 32(with `length` being 16).
- When we detect on `Authenticate`(source: db) that a user has the old format of salt, re-hash the password such that the user will have it's password hashed with increased salt.
Thanks to @zeripath for working out the rouge edges from my first commit 😄.
Co-authored-by: lafriks <lauris@nix.lv>
Co-authored-by: zeripath <art27@cantab.net>
40 lines
797 B
Go
40 lines
797 B
Go
// Copyright 2022 The Gitea Authors. All rights reserved.
|
|
// Use of this source code is governed by a MIT-style
|
|
// license that can be found in the LICENSE file.
|
|
|
|
package migrations
|
|
|
|
import (
|
|
"xorm.io/xorm"
|
|
"xorm.io/xorm/schemas"
|
|
)
|
|
|
|
func migrateUserPasswordSalt(x *xorm.Engine) error {
|
|
dbType := x.Dialect().URI().DBType
|
|
// For SQLITE, the max length doesn't matter.
|
|
if dbType == schemas.SQLITE {
|
|
return nil
|
|
}
|
|
|
|
if err := modifyColumn(x, "user", &schemas.Column{
|
|
Name: "rands",
|
|
SQLType: schemas.SQLType{
|
|
Name: "VARCHAR",
|
|
},
|
|
Length: 32,
|
|
// MySQL will like us again.
|
|
Nullable: true,
|
|
}); err != nil {
|
|
return err
|
|
}
|
|
|
|
return modifyColumn(x, "user", &schemas.Column{
|
|
Name: "salt",
|
|
SQLType: schemas.SQLType{
|
|
Name: "VARCHAR",
|
|
},
|
|
Length: 32,
|
|
Nullable: true,
|
|
})
|
|
}
|