mirror of https://github.com/go-gitea/gitea.git
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
623c93ff46
- The current implementation of `RandomString` doesn't give you a most-possible unique randomness. It gives you 6*`length` instead of the possible 8*`length` bits(or as `length`x bytes) randomness. This is because `RandomString` is being limited to a max value of 63, this in order to represent the random byte as a letter/digit.
- The recommendation of pbkdf2 is to use 64+ bit salt, which the `RandomString` doesn't give with a length of 10, instead of increasing 10 to a higher number, this patch adds a new function called `RandomBytes` which does give you the guarentee of 8*`length` randomness and thus corresponding of `length`x bytes randomness.
- Use hexadecimal to store the bytes value in the database, as mentioned, it doesn't play nice in order to convert it to a string. This will always be a length of 32(with `length` being 16).
- When we detect on `Authenticate`(source: db) that a user has the old format of salt, re-hash the password such that the user will have it's password hashed with increased salt.
Thanks to @zeripath for working out the rouge edges from my first commit 😄.
Co-authored-by: lafriks <lauris@nix.lv>
Co-authored-by: zeripath <art27@cantab.net>
|
3 years ago | |
|---|---|---|
| .. | ||
| activitypub | 4 years ago | |
| analyze | 4 years ago | |
| appstate | 3 years ago | |
| auth | 4 years ago | |
| avatar | 3 years ago | |
| base | 3 years ago | |
| cache | 3 years ago | |
| charset | 3 years ago | |
| context | 3 years ago | |
| convert | 3 years ago | |
| csv | 3 years ago | |
| doctor | 3 years ago | |
| emoji | 4 years ago | |
| eventsource | 3 years ago | |
| generate | 4 years ago | |
| git | 3 years ago | |
| gitgraph | 3 years ago | |
| graceful | 3 years ago | |
| hcaptcha | 5 years ago | |
| highlight | 3 years ago | |
| hostmatcher | 3 years ago | |
| httpcache | 3 years ago | |
| httplib | 4 years ago | |
| indexer | 3 years ago | |
| json | 3 years ago | |
| lfs | 3 years ago | |
| log | 3 years ago | |
| markup | 3 years ago | |
| metrics | 3 years ago | |
| migration | 3 years ago | |
| nosql | 3 years ago | |
| notification | 3 years ago | |
| options | 4 years ago | |
| password | 4 years ago | |
| pprof | 4 years ago | |
| private | 3 years ago | |
| process | 3 years ago | |
| proxy | 4 years ago | |
| public | 4 years ago | |
| queue | 3 years ago | |
| recaptcha | 4 years ago | |
| references | 3 years ago | |
| repository | 3 years ago | |
| secret | 3 years ago | |
| session | 3 years ago | |
| setting | 3 years ago | |
| ssh | 3 years ago | |
| storage | 4 years ago | |
| structs | 3 years ago | |
| svg | 4 years ago | |
| sync | 5 years ago | |
| templates | 3 years ago | |
| test | 3 years ago | |
| timeutil | 4 years ago | |
| translation | 3 years ago | |
| typesniffer | 3 years ago | |
| updatechecker | 3 years ago | |
| upload | 3 years ago | |
| uri | 3 years ago | |
| user | 5 years ago | |
| util | 3 years ago | |
| validation | 4 years ago | |
| web | 3 years ago | |