Skip to content

Commit 6b98dcd

Browse files
Bumer-32Bumer-32
committed
salt
1 parent 5af4ab8 commit 6b98dcd

File tree

7 files changed

+49
-31
lines changed

7 files changed

+49
-31
lines changed

‎src/main/kotlin/ua/pp/lumivoid/iwtcms/PREIWTCMS.kt‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,8 @@ object PREIWTCMS : PreLaunchEntrypoint {
6060
if (Users.selectAll().empty()) {
6161
Users.insert {
6262
it[username] = "admin"
63-
it[passwordHash] = DigestUtils.sha256Hex("iwtcms").toString()
63+
it[passwordHash] = DigestUtils.sha256Hex("iwtcms" + "ySXBvMifqXULEm1uRKP91ctmL6tCwCMi").toString()
64+
it[salt] = "ySXBvMifqXULEm1uRKP91ctmL6tCwCMi"
6465
it[uniqueId] = DigestUtils.sha256Hex("admin+iwtcms").toString()
6566
it[admin] = true
6667
}

‎src/main/kotlin/ua/pp/lumivoid/iwtcms/ktor/api/requests/CreateUser.kt‎

Lines changed: 20 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ import kotlinx.coroutines.runBlocking
99
import kotlinx.serialization.Serializable
1010
import org.apache.commons.codec.digest.DigestUtils
1111
import org.jetbrains.exposed.exceptions.ExposedSQLException
12+
import org.jetbrains.exposed.sql.SqlExpressionBuilder.eq
1213
import org.jetbrains.exposed.sql.insert
1314
import org.jetbrains.exposed.sql.selectAll
1415
import org.jetbrains.exposed.sql.transactions.transaction
@@ -17,7 +18,7 @@ import ua.pp.lumivoid.iwtcms.ktor.api.getPermissionsList
1718
import ua.pp.lumivoid.iwtcms.ktor.tables.UserPermissions
1819
import ua.pp.lumivoid.iwtcms.ktor.tables.Users
1920

20-
object CreateUserP : Request() {
21+
object CreateUser : Request() {
2122
override val path = "/api/createUser"
2223

2324
override val request: Routing.() -> Unit = {
@@ -29,14 +30,20 @@ object CreateUserP : Request() {
2930
permission = "create users",
3031
success = {
3132
transaction {
32-
try {
33+
var salt = generateSequence { genSalt() }
34+
.first { saltCandidate ->
35+
Users.selectAll().where(Users.salt eq saltCandidate).empty()
36+
}
37+
38+
runCatching {
3339
Users.insert {
3440
it[Users.username] = payload.username
35-
it[Users.passwordHash] = DigestUtils.sha256Hex(payload.password)
36-
it[Users.uniqueId] = DigestUtils.sha256Hex("${payload.username}+${payload.password}")
41+
it[Users.passwordHash] = DigestUtils.sha256Hex(payload.password + salt)
42+
it[Users.salt] = salt
43+
it[Users.uniqueId] = DigestUtils.sha256Hex("${payload.username}+${payload.password}+${salt}")
3744
it[Users.admin] = payload.isAdmin
3845
}
39-
} catch (_: ExposedSQLException) {
46+
}.onFailure {
4047
runBlocking { call.respondText("User already exists", status = HttpStatusCode.Conflict) }
4148
return@transaction
4249
}
@@ -60,6 +67,13 @@ object CreateUserP : Request() {
6067
)
6168
}
6269
}
70+
71+
fun genSalt(): String {
72+
val allowedChars = ('A'..'Z') + ('a'..'z') + ('0'..'9')
73+
return (1..32)
74+
.map { allowedChars.random() }
75+
.joinToString("")
76+
}
6377
}
6478

6579
@Serializable
@@ -68,4 +82,4 @@ data class CreateUserPayload(
6882
val password: String,
6983
val isAdmin: Boolean,
7084
val permissions: Map<String, Boolean>,
71-
)
85+
)

‎src/main/kotlin/ua/pp/lumivoid/iwtcms/ktor/api/requests/DeleteUser.kt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ import ua.pp.lumivoid.iwtcms.ktor.api.doAuth
1515
import ua.pp.lumivoid.iwtcms.ktor.tables.UserPermissions
1616
import ua.pp.lumivoid.iwtcms.ktor.tables.Users
1717

18-
object DeleteUserP : Request() {
18+
object DeleteUser : Request() {
1919
override val path = "/api/deleteUser"
2020

2121
override val request: Routing.() -> Unit = {

‎src/main/kotlin/ua/pp/lumivoid/iwtcms/ktor/api/requests/EditPermissions.kt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ import ua.pp.lumivoid.iwtcms.ktor.api.doAuth
1515
import ua.pp.lumivoid.iwtcms.ktor.tables.UserPermissions
1616
import ua.pp.lumivoid.iwtcms.ktor.tables.Users
1717

18-
object EditPermissionsP : Request() {
18+
object EditPermissions : Request() {
1919
override val path = "/api/editPermissions"
2020

2121
override val request: Routing.() -> Unit = {

‎src/main/kotlin/ua/pp/lumivoid/iwtcms/ktor/api/requests/Login.kt‎

Lines changed: 15 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -10,33 +10,35 @@ import io.ktor.server.sessions.set
1010
import kotlinx.serialization.Serializable
1111
import org.apache.commons.codec.digest.DigestUtils
1212
import org.jetbrains.exposed.sql.ResultRow
13-
import org.jetbrains.exposed.sql.and
1413
import org.jetbrains.exposed.sql.selectAll
1514
import org.jetbrains.exposed.sql.transactions.experimental.newSuspendedTransaction
1615
import ua.pp.lumivoid.iwtcms.ktor.cookie.UserSession
1716
import ua.pp.lumivoid.iwtcms.ktor.tables.Users
1817

19-
object LoginP : Request() {
18+
object Login : Request() {
2019
override val path = "/api/login"
2120

2221
override val request: Routing.() -> Unit = {
2322
post(path) {
2423
val payload = call.receive<LoginPayload>()
2524

2625
newSuspendedTransaction {
27-
val user: ResultRow =
28-
try {
29-
Users
30-
.selectAll()
31-
.where { (Users.username eq payload.username) and (Users.passwordHash eq DigestUtils.sha256Hex(payload.password)) }
32-
.first()
33-
} catch (_: NoSuchElementException) {
26+
try {
27+
val user: ResultRow = Users
28+
.selectAll()
29+
.where { (Users.username eq payload.username) }
30+
.first()
31+
val salt = user[Users.salt]
32+
33+
if (DigestUtils.sha256Hex(payload.password + salt) == user[Users.passwordHash]) {
34+
call.sessions.set(UserSession(user[Users.username], user[Users.uniqueId]))
35+
call.respondText("Login successful")
36+
} else {
3437
call.respondText("Login failed", status = HttpStatusCode.Unauthorized)
35-
return@newSuspendedTransaction
3638
}
37-
38-
call.sessions.set(UserSession(name = user[Users.username], id = user[Users.uniqueId]))
39-
call.respondText("Login successful")
39+
} catch (_: NoSuchElementException) {
40+
call.respondText("Login failed", status = HttpStatusCode.Unauthorized)
41+
}
4042
}
4143
}
4244
}

‎src/main/kotlin/ua/pp/lumivoid/iwtcms/ktor/plugins/Routing.kt‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -17,13 +17,13 @@ import io.ktor.server.websocket.timeout
1717
import ua.pp.lumivoid.iwtcms.Constants
1818
import ua.pp.lumivoid.iwtcms.ktor.api.requests.CheckLogin
1919
import ua.pp.lumivoid.iwtcms.ktor.api.requests.Configs
20-
import ua.pp.lumivoid.iwtcms.ktor.api.requests.CreateUserP
21-
import ua.pp.lumivoid.iwtcms.ktor.api.requests.DeleteUserP
22-
import ua.pp.lumivoid.iwtcms.ktor.api.requests.EditPermissionsP
20+
import ua.pp.lumivoid.iwtcms.ktor.api.requests.CreateUser
21+
import ua.pp.lumivoid.iwtcms.ktor.api.requests.DeleteUser
22+
import ua.pp.lumivoid.iwtcms.ktor.api.requests.EditPermissions
2323
import ua.pp.lumivoid.iwtcms.ktor.api.requests.Files
2424
import ua.pp.lumivoid.iwtcms.ktor.api.requests.IsAllowed
2525
import ua.pp.lumivoid.iwtcms.ktor.api.requests.IsDevEnabled
26-
import ua.pp.lumivoid.iwtcms.ktor.api.requests.LoginP
26+
import ua.pp.lumivoid.iwtcms.ktor.api.requests.Login
2727
import ua.pp.lumivoid.iwtcms.ktor.api.requests.Logout
2828
import ua.pp.lumivoid.iwtcms.ktor.api.requests.LogsHistory
2929
import ua.pp.lumivoid.iwtcms.ktor.api.requests.Main
@@ -76,17 +76,17 @@ fun Application.configureRouting() {
7676

7777
Main.register(r)
7878
LogsHistory.register(r)
79-
LoginP.register(r)
79+
Login.register(r)
8080
IsAllowed.register(r)
8181
Files.register(r)
8282
Version.register(r)
8383
CheckLogin.register(r)
8484
IsDevEnabled.register(r)
8585
Logout.register(r)
8686
Configs.register(r)
87-
CreateUserP.register(r)
88-
DeleteUserP.register(r)
89-
EditPermissionsP.register(r)
87+
CreateUser.register(r)
88+
DeleteUser.register(r)
89+
EditPermissions.register(r)
9090

9191
ConsoleWS.register(r)
9292
ServerStatsWS.register(r)

‎src/main/kotlin/ua/pp/lumivoid/iwtcms/ktor/tables/Users.kt‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ object Users : Table("users") {
66
val id = integer("id").autoIncrement()
77
val username = varchar("username", 128).uniqueIndex()
88
val passwordHash = char("password_hash", 64)
9-
val uniqueId = char("unique_id", 64)
9+
val salt = char("salt", 32).uniqueIndex()
10+
val uniqueId = char("unique_id", 64).uniqueIndex()
1011
val admin = bool("admin").default(false)
1112
}

0 commit comments

Comments
 (0)