Update changelog

1º Let the admin choose if the passwords should be overwriten using crypt; 2º minor fixes

README.md

@@ -66,7 +66,7 @@ If you use YunoHost, you may want to edit the `/etc/ssowat/conf.json.persistent`
 
 ## Available parameters
 
-These are the SSOwat's configuration parameters. Only `portal_domain` and `skipped_urls` are required, but it is recommended to know the others to fully understand what you can do with SSOwat.
+These are the SSOwat's configuration parameters. Only `portal_domain` is required, but it is recommended to know the others to fully understand what you can do with SSOwat.
 
 #### portal_domain
 
@@ -104,6 +104,10 @@ LDAP user identifier (**default**: `uid`)
 
 User's attributes to fetch from LDAP (**default**: `["uid", "givenname", "sn", "cn", "homedirectory", "mail", "maildrop"]`)
 
+#### ldap_enforce_crypt
+
+Let SSOwat re-encrypt weakly-encrypted LDAP passwords into the safer sha-512 (crypt) (**default**: `true`)
+
 #### allow_mail_authentication
 
 Whether users can authenticate with their mail address (**default**: `true`)

config.lua

@@ -50,6 +50,8 @@ function get_config()
         ldap_host                 = "localhost",
         ldap_group                = "ou=users,dc=yunohost,dc=org",
         ldap_identifier           = "uid",
+        ldap_enforce_crypt        = true,
+        skipped_urls              = {},
         ldap_attributes           = {"uid", "givenname", "sn", "cn", "homedirectory", "mail", "maildrop"},
         allow_mail_authentication = true,
         default_language          = "en"

debian/changelog

@@ -1,3 +1,11 @@
+ssowat (2.7.15) stable; urgency=low
+
+  * Add a warning about Jessie being deprecated and encouragement to migrate
+    to Stretch / 3.x
+  * [fix] CVE-2018-11347 http header injection (by Bram)
+
+ -- Alexandre Aubin <alex.aubin@mailoo.org>  Tue, 08 Jan 2019 18:00:00 +0000
+
 ssowat (2.7.14) stable; urgency=low
 
   * Make tile dragging work on mobile devices

helpers.lua

@@ -293,7 +293,9 @@ function authenticate(user, password)
     -- cache shared table in order to eventually reuse it later when updating
     -- profile information or just passing credentials to an application.
     if connected then
-        ensure_user_password_uses_strong_hash(connected, user, password)
+        if conf['ldap_enforce_crypt'] then
+            ensure_user_password_uses_strong_hash(connected, user, password)
+        end
         cache:add(user.."-password", password, conf["session_timeout"])
         ngx.log(ngx.NOTICE, "Connected as: "..user)
         return user
@@ -575,12 +577,13 @@ end
 -- if it's not the case, it migrates the password to this new hash algorithm
 function ensure_user_password_uses_strong_hash(ldap, user, password)
     local current_hashed_password = nil
+    conf = config.get_config()
 
     for dn, attrs in ldap:search {
-        base = "ou=users,dc=yunohost,dc=org",
+        base = conf['ldap_group'],
         scope = "onelevel",
         sizelimit = 1,
-        filter = "(uid="..user..")",
+        filter = "("..conf['ldap_identifier'].."="..user..")",
         attrs = {"userPassword"}
     } do
         current_hashed_password = attrs["userPassword"]:sub(0, 10)
@@ -866,6 +869,14 @@ function login()
     -- Forward the `r` URI argument if it exists to redirect
     -- the user properly after a successful login.
     if uri_args.r then
+        -- If `uri_args.r` contains line break, someone is probably trying to
+        -- pass some additional headers
+        if string.match(uri_args.r, "(.*)\n") then
+            flash("fail", t("redirection_error_invalid_url"))
+            ngx.log(ngx.ERR, "Redirection url is invalid")
+            return redirect(conf.portal_url)
+        end
+
         return redirect(conf.portal_url.."?r="..uri_args.r)
     else
         return redirect(conf.portal_url)

portal/info.html

@@ -1,3 +1,5 @@
+<div class="wrapper messages warning">{{t_obsolete_version}}</div>
+
 <div class="ynh-wrapper user">
   <ul class="user-menu">
     <li><a class="icon icon-connexion" href="?action=logout">{{t_logout}}</a></li>

portal/locales/en.json

@@ -19,6 +19,7 @@
    "confirm": "Confirm",
    "login": "Login",
    "logout": "Logout",
+   "obsolete_version": "The version of YunoHost running on this server is obsolete and should be upgraded to YunoHost 3.x / Stretch. Please contact your administrator about this.",
    "password_changed": "Password successfully changed",
    "password_changed_error": "An error occurred on password changing",
    "password_not_match": "New passwords don't match",