mirror of https://github.com/go-gitea/gitea.git
623c93ff46
- The current implementation of `RandomString` doesn't give you a most-possible unique randomness. It gives you 6*`length` instead of the possible 8*`length` bits(or as `length`x bytes) randomness. This is because `RandomString` is being limited to a max value of 63, this in order to represent the random byte as a letter/digit.
- The recommendation of pbkdf2 is to use 64+ bit salt, which the `RandomString` doesn't give with a length of 10, instead of increasing 10 to a higher number, this patch adds a new function called `RandomBytes` which does give you the guarentee of 8*`length` randomness and thus corresponding of `length`x bytes randomness.
- Use hexadecimal to store the bytes value in the database, as mentioned, it doesn't play nice in order to convert it to a string. This will always be a length of 32(with `length` being 16).
- When we detect on `Authenticate`(source: db) that a user has the old format of salt, re-hash the password such that the user will have it's password hashed with increased salt.
Thanks to @zeripath for working out the rouge edges from my first commit 😄.
Co-authored-by: lafriks <lauris@nix.lv>
Co-authored-by: zeripath <art27@cantab.net>
|
||
|---|---|---|
| .. | ||
| admin | ||
| appstate | ||
| asymkey | ||
| auth | ||
| avatars | ||
| db | ||
| fixtures | ||
| issues | ||
| migrations | ||
| perm | ||
| repo | ||
| unit | ||
| unittest | ||
| user | ||
| webhook | ||
| access.go | ||
| access_test.go | ||
| action.go | ||
| action_list.go | ||
| action_test.go | ||
| branches.go | ||
| branches_test.go | ||
| commit.go | ||
| commit_status.go | ||
| commit_status_test.go | ||
| consistency.go | ||
| consistency_test.go | ||
| engine_test.go | ||
| error.go | ||
| fixture_generation.go | ||
| fixture_test.go | ||
| helper.go | ||
| helper_directory.go | ||
| helper_environment.go | ||
| issue.go | ||
| issue_assignees.go | ||
| issue_assignees_test.go | ||
| issue_comment.go | ||
| issue_comment_list.go | ||
| issue_comment_test.go | ||
| issue_dependency.go | ||
| issue_dependency_test.go | ||
| issue_label.go | ||
| issue_label_test.go | ||
| issue_list.go | ||
| issue_list_test.go | ||
| issue_lock.go | ||
| issue_milestone.go | ||
| issue_milestone_test.go | ||
| issue_reaction.go | ||
| issue_reaction_test.go | ||
| issue_stopwatch.go | ||
| issue_stopwatch_test.go | ||
| issue_test.go | ||
| issue_tracked_time.go | ||
| issue_tracked_time_test.go | ||
| issue_user.go | ||
| issue_user_test.go | ||
| issue_watch.go | ||
| issue_watch_test.go | ||
| issue_xref.go | ||
| issue_xref_test.go | ||
| lfs.go | ||
| lfs_lock.go | ||
| main_test.go | ||
| migrate.go | ||
| migrate_test.go | ||
| notification.go | ||
| notification_test.go | ||
| org.go | ||
| org_team.go | ||
| org_team_test.go | ||
| org_test.go | ||
| project.go | ||
| project_board.go | ||
| project_issue.go | ||
| project_test.go | ||
| protected_tag.go | ||
| protected_tag_test.go | ||
| pull.go | ||
| pull_list.go | ||
| pull_test.go | ||
| release.go | ||
| repo.go | ||
| repo_activity.go | ||
| repo_collaboration.go | ||
| repo_collaboration_test.go | ||
| repo_generate.go | ||
| repo_generate_test.go | ||
| repo_list.go | ||
| repo_list_test.go | ||
| repo_permission.go | ||
| repo_permission_test.go | ||
| repo_test.go | ||
| repo_transfer.go | ||
| repo_transfer_test.go | ||
| review.go | ||
| review_test.go | ||
| statistic.go | ||
| task.go | ||
| token.go | ||
| token_test.go | ||
| upload.go | ||
| user.go | ||
| user_heatmap.go | ||
| user_heatmap_test.go | ||
| user_test.go | ||
| userlist.go | ||
| userlist_test.go | ||