mirror of
https://github.com/go-gitea/gitea
synced 2024-09-08 10:25:40 +02:00
- The current implementation of `RandomString` doesn't give you a most-possible unique randomness. It gives you 6*`length` instead of the possible 8*`length` bits(or as `length`x bytes) randomness. This is because `RandomString` is being limited to a max value of 63, this in order to represent the random byte as a letter/digit.
- The recommendation of pbkdf2 is to use 64+ bit salt, which the `RandomString` doesn't give with a length of 10, instead of increasing 10 to a higher number, this patch adds a new function called `RandomBytes` which does give you the guarentee of 8*`length` randomness and thus corresponding of `length`x bytes randomness.
- Use hexadecimal to store the bytes value in the database, as mentioned, it doesn't play nice in order to convert it to a string. This will always be a length of 32(with `length` being 16).
- When we detect on `Authenticate`(source: db) that a user has the old format of salt, re-hash the password such that the user will have it's password hashed with increased salt.
Thanks to @zeripath for working out the rouge edges from my first commit 😄.
Co-authored-by: lafriks <lauris@nix.lv>
Co-authored-by: zeripath <art27@cantab.net>
|
||
---|---|---|
.. | ||
activitypub | ||
analyze | ||
appstate | ||
auth | ||
avatar | ||
base | ||
cache | ||
charset | ||
context | ||
convert | ||
csv | ||
doctor | ||
emoji | ||
eventsource | ||
generate | ||
git | ||
gitgraph | ||
graceful | ||
hcaptcha | ||
highlight | ||
hostmatcher | ||
httpcache | ||
httplib | ||
indexer | ||
json | ||
lfs | ||
log | ||
markup | ||
metrics | ||
migration | ||
nosql | ||
notification | ||
options | ||
password | ||
pprof | ||
private | ||
process | ||
proxy | ||
public | ||
queue | ||
recaptcha | ||
references | ||
repository | ||
secret | ||
session | ||
setting | ||
ssh | ||
storage | ||
structs | ||
svg | ||
sync | ||
templates | ||
test | ||
timeutil | ||
translation | ||
typesniffer | ||
updatechecker | ||
upload | ||
uri | ||
user | ||
util | ||
validation | ||
web |