From 945b04cc67da3c4ae034129bb5cc79dfd60ae7e7 Mon Sep 17 00:00:00 2001 From: ljf Date: Wed, 29 Aug 2018 00:47:59 +0200 Subject: [PATCH 1/4] [fix] Regex todo --- helpers.lua | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/helpers.lua b/helpers.lua index 89fba97..e32bb9b 100644 --- a/helpers.lua +++ b/helpers.lua @@ -598,7 +598,7 @@ function ensure_user_password_uses_strong_hash(ldap, user, password) end -- Read result of a command after given it securely the password -function secure_cmd_password(cmd, password) +function secure_cmd_password(cmd, password, start) -- Check password validity math.randomseed( os.time() ) local tmp_file = "/tmp/ssowat_"..math.random() @@ -611,10 +611,13 @@ function secure_cmd_password(cmd, password) local text = "" for line in io.lines(tmp_file) do i = i + 1 - if i > 4 then + if i > start then text = text..line.."\n" end end + if i > start then + text = text:sub(1, -2) + end r_pwd:close() os.remove(tmp_file) ngx.log(ngx.STDERR, text) @@ -651,7 +654,7 @@ function edit_user() -- and the new password against the confirmation field's content if args.newpassword == args.confirm then -- Check password validity - local valid_result = secure_cmd_password("( python /usr/lib/moulinette/yunohost/utils/password.py 2>&1 || echo ::ERROR:: ) | tee -a %s", args.newpassword) + local valid_result = secure_cmd_password("( python /usr/lib/moulinette/yunohost/utils/password.py 2>&1 || echo ::ERROR:: ) | tee -a %s", args.newpassword, 4) -- We remove 4 lines due to a Warning message local i = 0 local validation_error = nil @@ -883,11 +886,9 @@ end -- hash the user password using sha-512 and using {CRYPT} to uses linux auth system -- because ldap doesn't support anything stronger than sha1 function hash_password(password) - -- TODO is the password checked by regex? we don't want to - -- allow shell injection - local mkpasswd = io.popen("mkpasswd --method=sha-512 '" ..password:gsub("'", "'\\''").."'") - local hashed_password = "{CRYPT}"..mkpasswd:read() - mkpasswd:close() + local hashed_password = secure_cmd_password("mkpasswd --method=sha-512 | tee -a %s", password, 0) + ngx.log(ngx.STDERR, hashed_password) + hashed_password = "{CRYPT}"..hashed_password return hashed_password end @@ -901,7 +902,7 @@ function login() local uri_args = ngx.req.get_uri_args() args.user = string.lower(args.user) - + local user = authenticate(args.user, args.password) if user then ngx.status = ngx.HTTP_CREATED From d83b522d5091720bdbe699ea7a6c3454febce7b7 Mon Sep 17 00:00:00 2001 From: ljf Date: Wed, 29 Aug 2018 00:56:24 +0200 Subject: [PATCH 2/4] [fix] Remove some nginx debug log --- helpers.lua | 1 - 1 file changed, 1 deletion(-) diff --git a/helpers.lua b/helpers.lua index e32bb9b..a384efb 100644 --- a/helpers.lua +++ b/helpers.lua @@ -887,7 +887,6 @@ end -- because ldap doesn't support anything stronger than sha1 function hash_password(password) local hashed_password = secure_cmd_password("mkpasswd --method=sha-512 | tee -a %s", password, 0) - ngx.log(ngx.STDERR, hashed_password) hashed_password = "{CRYPT}"..hashed_password return hashed_password end From 349d486cec74add0ddd4a7f556013ad9a82dd0ba Mon Sep 17 00:00:00 2001 From: ljf Date: Wed, 29 Aug 2018 01:08:36 +0200 Subject: [PATCH 3/4] [fix] Remove some nginx debug log --- helpers.lua | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/helpers.lua b/helpers.lua index a384efb..723b62b 100644 --- a/helpers.lua +++ b/helpers.lua @@ -602,8 +602,10 @@ function secure_cmd_password(cmd, password, start) -- Check password validity math.randomseed( os.time() ) local tmp_file = "/tmp/ssowat_"..math.random() - local w_pwd = io.popen(string.format(cmd, tmp_file), 'w') + local w_pwd = io.popen("("..cmd..") tee -a "..tmp_file, 'w') w_pwd:write(password) + -- This second write is just to validate the password question + -- Do not remove w_pwd:write("") w_pwd:close() local r_pwd = io.open(tmp_file, 'r') @@ -654,7 +656,7 @@ function edit_user() -- and the new password against the confirmation field's content if args.newpassword == args.confirm then -- Check password validity - local valid_result = secure_cmd_password("( python /usr/lib/moulinette/yunohost/utils/password.py 2>&1 || echo ::ERROR:: ) | tee -a %s", args.newpassword, 4) + local valid_result = secure_cmd_password("python /usr/lib/moulinette/yunohost/utils/password.py 2>&1 || echo ::ERROR::", args.newpassword, 4) -- We remove 4 lines due to a Warning message local i = 0 local validation_error = nil @@ -886,7 +888,7 @@ end -- hash the user password using sha-512 and using {CRYPT} to uses linux auth system -- because ldap doesn't support anything stronger than sha1 function hash_password(password) - local hashed_password = secure_cmd_password("mkpasswd --method=sha-512 | tee -a %s", password, 0) + local hashed_password = secure_cmd_password("mkpasswd --method=sha-512", password, 0) hashed_password = "{CRYPT}"..hashed_password return hashed_password end From 7627101eb5c10a2ea77ad5ba0743407303d9263b Mon Sep 17 00:00:00 2001 From: ljf Date: Wed, 29 Aug 2018 01:26:19 +0200 Subject: [PATCH 4/4] [enh] Simplify code thanks to change on password.py --- helpers.lua | 31 ++++++------------------------- 1 file changed, 6 insertions(+), 25 deletions(-) diff --git a/helpers.lua b/helpers.lua index 723b62b..99cfc83 100644 --- a/helpers.lua +++ b/helpers.lua @@ -609,20 +609,9 @@ function secure_cmd_password(cmd, password, start) w_pwd:write("") w_pwd:close() local r_pwd = io.open(tmp_file, 'r') - local i = 0 - local text = "" - for line in io.lines(tmp_file) do - i = i + 1 - if i > start then - text = text..line.."\n" - end - end - if i > start then - text = text:sub(1, -2) - end + text = r_pwd:read "*a" r_pwd:close() os.remove(tmp_file) - ngx.log(ngx.STDERR, text) return text end @@ -656,19 +645,11 @@ function edit_user() -- and the new password against the confirmation field's content if args.newpassword == args.confirm then -- Check password validity - local valid_result = secure_cmd_password("python /usr/lib/moulinette/yunohost/utils/password.py 2>&1 || echo ::ERROR::", args.newpassword, 4) - -- We remove 4 lines due to a Warning message - local i = 0 - local validation_error = nil - local result_msg = nil + local result_msg = secure_cmd_password("python /usr/lib/moulinette/yunohost/utils/password.py", args.newpassword) + validation_error = true - for line in string.gmatch(valid_result, "[^\n]+") do - if i == 0 then - result_msg = line - else - validation_error = line - end - i = i + 1 + if result_msg == 'password_advice' or result_msg == nil or result_msg == "" then + validation_error = nil end if validation_error == nil then @@ -888,7 +869,7 @@ end -- hash the user password using sha-512 and using {CRYPT} to uses linux auth system -- because ldap doesn't support anything stronger than sha1 function hash_password(password) - local hashed_password = secure_cmd_password("mkpasswd --method=sha-512", password, 0) + local hashed_password = secure_cmd_password("mkpasswd --method=sha-512", password) hashed_password = "{CRYPT}"..hashed_password return hashed_password end