password_rehasher 0.2.0 → 0.2.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/README.md +3 -15
- data/lib/password_rehasher.rb +9 -7
- data/spec/password_rehasher_spec.rb +8 -3
- metadata +1 -1
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA1:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 3785e236bd7d813a1b945addcd37a9f8e066a7c1
|
|
4
|
+
data.tar.gz: 87563fd8c88328b15f3ac9af781c5ac2e3342d1c
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: db594e3b4862bb8c09fa19e50112ee4302766bbd0f655996cfadf6890087884291c89251f64ace16aa3c91d5da15c0a19011fab484b648cd36c2f8f025c3ec47
|
|
7
|
+
data.tar.gz: 08ef8ca01cee4be81321ac0a68cd6c7985e100494e34ab42a9805df5a97728a716d90ab69e5b2361f8ccfa44bdfe95553613514b5a975445625c42c1cba54803
|
data/README.md
CHANGED
|
@@ -4,20 +4,6 @@ Password Rehasher is a temporary gem to rehash the passwords in the RPM database
|
|
|
4
4
|
|
|
5
5
|
## Usage
|
|
6
6
|
|
|
7
|
-
```ruby
|
|
8
|
-
if (PasswordRehasher.password_valid?(plaintext_password, crypted_password)) {
|
|
9
|
-
if (PasswordRehasher.rehash_needed?(crypted_password)) {
|
|
10
|
-
user.crypted_password = PasswordRehasher.hash_password(plaintext_password)
|
|
11
|
-
user.save
|
|
12
|
-
}
|
|
13
|
-
# user is logged in
|
|
14
|
-
} else {
|
|
15
|
-
# user is not logged in
|
|
16
|
-
}
|
|
17
|
-
```
|
|
18
|
-
|
|
19
|
-
## Alternatively, to do all of the above if user.update_attribute("crypted_password", crypted_password) is what you want to do
|
|
20
|
-
|
|
21
7
|
```ruby
|
|
22
8
|
if (PasswordRehasher.validate_and_rehash?(user, plaintext_password, crypted_password)) {
|
|
23
9
|
# user is logged in and the password is rehashed (if necessary)
|
|
@@ -25,4 +11,6 @@ if (PasswordRehasher.validate_and_rehash?(user, plaintext_password, crypted_pass
|
|
|
25
11
|
# user is not logged in
|
|
26
12
|
}
|
|
27
13
|
|
|
28
|
-
```
|
|
14
|
+
```
|
|
15
|
+
|
|
16
|
+
`user` needs to be an object that responds to `update_attribute` and `salt`.
|
data/lib/password_rehasher.rb
CHANGED
|
@@ -2,18 +2,20 @@ require "scrypt"
|
|
|
2
2
|
require 'digest/sha1'
|
|
3
3
|
|
|
4
4
|
class PasswordRehasher
|
|
5
|
-
VERSION = "0.2.
|
|
5
|
+
VERSION = "0.2.1"
|
|
6
6
|
|
|
7
|
-
def self.password_valid?(plaintext_password, hashed_password)
|
|
8
|
-
case hashed_password.length
|
|
7
|
+
def self.password_valid?(plaintext_password, hashed_password, salt = nil)
|
|
8
|
+
case hashed_password.length
|
|
9
9
|
when 40
|
|
10
|
-
|
|
10
|
+
return false unless salt
|
|
11
|
+
hashed_password == Digest::SHA1.hexdigest("--#{salt}--#{plaintext_password}--")
|
|
11
12
|
when 90
|
|
12
13
|
password = SCrypt::Password.new(hashed_password)
|
|
13
14
|
password == plaintext_password
|
|
14
15
|
when 103
|
|
16
|
+
return false unless salt
|
|
15
17
|
scrypt_plus_sha1_hash = hashed_password[13..-1]
|
|
16
|
-
sha1_hashed_password = Digest::SHA1.hexdigest(plaintext_password)
|
|
18
|
+
sha1_hashed_password = Digest::SHA1.hexdigest("--#{salt}--#{plaintext_password}--")
|
|
17
19
|
password = SCrypt::Password.new(scrypt_plus_sha1_hash)
|
|
18
20
|
password == sha1_hashed_password
|
|
19
21
|
else
|
|
@@ -30,7 +32,7 @@ class PasswordRehasher
|
|
|
30
32
|
end
|
|
31
33
|
|
|
32
34
|
def self.validate_and_rehash?(user, plaintext_password, hashed_password)
|
|
33
|
-
if (plaintext_password && password_valid?(plaintext_password, hashed_password))
|
|
35
|
+
if (plaintext_password && password_valid?(plaintext_password, hashed_password, user.salt))
|
|
34
36
|
if (rehash_needed?(hashed_password))
|
|
35
37
|
user.update_attribute("crypted_password", hash_password(plaintext_password))
|
|
36
38
|
end
|
|
@@ -39,4 +41,4 @@ class PasswordRehasher
|
|
|
39
41
|
return false
|
|
40
42
|
end
|
|
41
43
|
end
|
|
42
|
-
end
|
|
44
|
+
end
|
|
@@ -2,8 +2,8 @@ describe PasswordRehasher do
|
|
|
2
2
|
let(:plaintext_password) { "some_password" }
|
|
3
3
|
let(:incorrect_plaintext_password) { "some_passwords" }
|
|
4
4
|
|
|
5
|
-
let(:sha1_hashed_password) { "
|
|
6
|
-
let(:nested_hashed_password) { "nested hash: 400$8$
|
|
5
|
+
let(:sha1_hashed_password) { "e4f85605cb02d2223d4f30c5ef5e6c38e662ae76" }
|
|
6
|
+
let(:nested_hashed_password) { "nested hash: 400$8$39$bade652ec1b7cbb3$2e6efe19f8af6bb19a12ad9d62369fef50a12804f4be30bdc46c6626d3e07287" }
|
|
7
7
|
let(:scrypt_hashed_password) { "400$8$38$76f69b1ead11cf5c$b0e509793a43e66d206d549cec5f039acf15b52fe965cd3b5d855408459c3ddb" }
|
|
8
8
|
let(:invalid_hashed_password) { "400$8$38$76f60b1ead11cf5c$b0e509793a43e66d206d549cec5f039acf15b52fe965cd3b5d855408459c3ddb" }
|
|
9
9
|
|
|
@@ -14,7 +14,8 @@ describe PasswordRehasher do
|
|
|
14
14
|
end
|
|
15
15
|
|
|
16
16
|
describe '.password_valid?' do
|
|
17
|
-
subject { PasswordRehasher.password_valid?(plaintext_password, hashed_password) }
|
|
17
|
+
subject { PasswordRehasher.password_valid?(plaintext_password, hashed_password, salt) }
|
|
18
|
+
let(:salt) { "random salt" }
|
|
18
19
|
|
|
19
20
|
context 'with a SHA1 hash' do
|
|
20
21
|
let(:hashed_password) { sha1_hashed_password }
|
|
@@ -121,4 +122,8 @@ class MockUser
|
|
|
121
122
|
@crypted_password = value
|
|
122
123
|
# attribute is always "crypted_password" for now
|
|
123
124
|
end
|
|
125
|
+
|
|
126
|
+
def salt
|
|
127
|
+
"random salt"
|
|
128
|
+
end
|
|
124
129
|
end
|