From a877209c8b0c7c476ee6676c6d00c4cacdc83207 Mon Sep 17 00:00:00 2001
From: Richard van der Hoff <richard@matrix.org>
Date: Wed, 16 Mar 2016 09:45:37 +0000
Subject: [PATCH 1/2] Password reset docs and script

Replace the bash/perl gen_password script with a python one, and write a note
on how to use it.
---
 README.rst            | 20 ++++++++++++++++++++
 scripts/gen_password  |  1 -
 scripts/hash_password | 39 +++++++++++++++++++++++++++++++++++++++
 3 files changed, 59 insertions(+), 1 deletion(-)
 delete mode 100644 scripts/gen_password
 create mode 100755 scripts/hash_password

diff --git a/README.rst b/README.rst
index 8a745259b..a48a0802b 100644
--- a/README.rst
+++ b/README.rst
@@ -525,6 +525,26 @@ Logging In To An Existing Account
 Just enter the ``@localpart:my.domain.here`` Matrix user ID and password into
 the form and click the Login button.
 
+Password reset
+==============
+
+Synapse does not yet support a password-reset function (see
+https://matrix.org/jira/browse/SYN-11). In the meantime, it is possible to
+manually reset a user's password via direct database access.
+
+First calculate the hash of the new password:
+
+    $ source ~/.synapse/bin/activate
+    $ ./scripts/hash_password
+    Password: 
+    Confirm password: 
+    $2a$12$xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+
+Then update the `users` table in the database:
+
+    UPDATE users SET password_hash='$2a$12$xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
+        WHERE name='@test:test.com';
+
 
 Identity Servers
 ================
diff --git a/scripts/gen_password b/scripts/gen_password
deleted file mode 100644
index 7afd3a5df..000000000
--- a/scripts/gen_password
+++ /dev/null
@@ -1 +0,0 @@
-perl -MCrypt::Random -MCrypt::Eksblowfish::Bcrypt -e 'print Crypt::Eksblowfish::Bcrypt::bcrypt("secret", "\$2\$12\$" . Crypt::Eksblowfish::Bcrypt::en_base64(Crypt::Random::makerandom_octet(Length=>16)))."\n"'
diff --git a/scripts/hash_password b/scripts/hash_password
new file mode 100755
index 000000000..e78460098
--- /dev/null
+++ b/scripts/hash_password
@@ -0,0 +1,39 @@
+#!/usr/bin/env python
+
+import argparse
+import bcrypt
+import getpass
+
+bcrypt_rounds=12
+
+def prompt_for_pass():
+    password = getpass.getpass("Password: ")
+
+    if not password:
+        raise Exception("Password cannot be blank.")
+
+    confirm_password = getpass.getpass("Confirm password: ")
+
+    if password != confirm_password:
+        raise Exception("Passwords do not match.")
+
+    return password
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(
+        description="Calculate the hash of a new password, so that passwords"
+                    " can be reset")
+    parser.add_argument(
+        "-p", "--password",
+        default=None,
+        help="New password for user. Will prompt if omitted.",
+    )
+
+    args = parser.parse_args()
+    password = args.password
+
+    if not password:
+        password = prompt_for_pass()
+
+    print bcrypt.hashpw(password, bcrypt.gensalt(bcrypt_rounds))
+

From 660ae8e0f3c7f667b3a24b02f095d60c2b09531f Mon Sep 17 00:00:00 2001
From: Richard van der Hoff <richard@matrix.org>
Date: Wed, 16 Mar 2016 10:40:38 +0000
Subject: [PATCH 2/2] Clarify that we do have reset functionality via the IS

---
 README.rst | 41 ++++++++++++++++++++---------------------
 1 file changed, 20 insertions(+), 21 deletions(-)

diff --git a/README.rst b/README.rst
index a48a0802b..285fc5aa8 100644
--- a/README.rst
+++ b/README.rst
@@ -525,27 +525,6 @@ Logging In To An Existing Account
 Just enter the ``@localpart:my.domain.here`` Matrix user ID and password into
 the form and click the Login button.
 
-Password reset
-==============
-
-Synapse does not yet support a password-reset function (see
-https://matrix.org/jira/browse/SYN-11). In the meantime, it is possible to
-manually reset a user's password via direct database access.
-
-First calculate the hash of the new password:
-
-    $ source ~/.synapse/bin/activate
-    $ ./scripts/hash_password
-    Password: 
-    Confirm password: 
-    $2a$12$xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
-
-Then update the `users` table in the database:
-
-    UPDATE users SET password_hash='$2a$12$xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
-        WHERE name='@test:test.com';
-
-
 Identity Servers
 ================
 
@@ -565,6 +544,26 @@ as the primary means of identity and E2E encryption is not complete. As such,
 we are running a single identity server (https://matrix.org) at the current
 time.
 
+Password reset
+==============
+
+If a user has registered an email address to their account using an identity
+server, they can request a password-reset token via clients such as Vector.
+
+A manual password reset can be done via direct database access as follows.
+
+First calculate the hash of the new password:
+
+    $ source ~/.synapse/bin/activate
+    $ ./scripts/hash_password
+    Password: 
+    Confirm password: 
+    $2a$12$xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+
+Then update the `users` table in the database:
+
+    UPDATE users SET password_hash='$2a$12$xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
+        WHERE name='@test:test.com';
 
 Where's the spec?!
 ==================