bitPickups/friendica_2020-09-1_sharedHosting
1
0
Fork 0
Code Pull requests Activity

Allow colon in password

Browse source 
- It was disallowed because of a too strict intepretation of RFC2617
This commit is contained in:
Hypolite Petovan 2023-01-18 20:33:39 -05:00
parent 81cd334664
commit d2033d4c92
4 changed files with 9 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
src/Model/User.php
View file

@ -757,7 +757,7 @@ class User
}
/**
* Allowed characters are a-z, A-Z, 0-9 and special characters except white spaces, accentuated letters and colon (:).
* Allowed characters are a-z, A-Z, 0-9 and special characters except white spaces and accentuated letters.
*
* Password length is limited to 72 characters if the current default password hashing algorithm is Blowfish.
* From the manual: "Using the PASSWORD_BCRYPT as the algorithm, will result in the password parameter being
@ -770,7 +770,7 @@ class User
*/
public static function getPasswordRegExp(string $delimiter = null): string
{
$allowed_characters = '!"#$%&\'()*+,-./;<=>?@[\]^_`{|}~';
$allowed_characters = ':!"#$%&\'()*+,-./;<=>?@[\]^_`{|}~';
if ($delimiter) {
$allowed_characters = preg_quote($allowed_characters, $delimiter);
@ -804,7 +804,7 @@ class User
}
if (!preg_match('/' . self::getPasswordRegExp('/') . '/', $password)) {
throw new Exception(DI::l10n()->t('The password can\'t contain accentuated letters, white spaces or colons (:)'));
throw new Exception(DI::l10n()->t("The password can't contain white spaces nor accentuated letters"));
}
return self::updatePasswordHashed($uid, self::hashPassword($password));

5
src/Module/OAuth/Token.php
View file

@ -61,7 +61,10 @@ class Token extends BaseApi
}
if (empty($request['client_id']) && substr($authorization, 0, 6) == 'Basic ') {
$datapair = explode(':', base64_decode(trim(substr($authorization, 6))));
// Per RFC2617, usernames can't contain a colon but password can,
// so we cut on the first colon to obtain the username and the password
// @see https://www.rfc-editor.org/rfc/rfc2617#section-2
$datapair = explode(':', base64_decode(trim(substr($authorization, 6))), 2);
if (count($datapair) == 2) {
$request['client_id'] = $datapair[0];
$request['client_secret'] = $datapair[1];

2
src/Module/Security/PasswordTooLong.php
View file

@ -98,7 +98,7 @@ class PasswordTooLong extends \Friendica\BaseModule
'$return_url' => $request['return_url'] ?? '',
'$password_current' => ['password_current', $this->l10n->t('Current Password:'), '', $this->l10n->t('Your current password to confirm the changes'), 'required', 'autocomplete="off"'],
'$password' => ['password', $this->l10n->t('New Password:'), '', $this->l10n->t('Allowed characters are a-z, A-Z, 0-9 and special characters except white spaces, accentuated letters and colon (:).') . ' ' . $this->l10n->t('Password length is limited to 72 characters.'), 'required', 'autocomplete="off"', User::getPasswordRegExp()],
'$password' => ['password', $this->l10n->t('New Password:'), '', $this->l10n->t('Allowed characters are a-z, A-Z, 0-9 and special characters except white spaces and accentuated letters.') . ' ' . $this->l10n->t('Password length is limited to 72 characters.'), 'required', 'autocomplete="off"', User::getPasswordRegExp()],
'$password_confirm' => ['password_confirm', $this->l10n->t('Confirm:'), '', '', 'required', 'autocomplete="off"'],
]);

2
src/Module/Settings/Account.php
View file

@ -549,7 +549,7 @@ class Account extends BaseSettings
$notify_type = DI::pConfig()->get(DI::userSession()->getLocalUserId(), 'system', 'notify_type');
$passwordRules = DI::l10n()->t('Allowed characters are a-z, A-Z, 0-9 and special characters except white spaces, accentuated letters and colon (:).')
$passwordRules = DI::l10n()->t('Allowed characters are a-z, A-Z, 0-9 and special characters except white spaces and accentuated letters.')
. (PASSWORD_DEFAULT === PASSWORD_BCRYPT ? ' ' . DI::l10n()->t('Password length is limited to 72 characters.') : '');
$tpl = Renderer::getMarkupTemplate('settings/account.tpl');