kallithea Changeset - 023d9202481e

Changeset - 023d9202481e

Parent rev.

Child rev.

[Not reviewed]

default

0 2 0

Andrew Shadura - 9 years ago 2016-07-03 12:21:00
andrew@shadura.me

setup: use modern bcrypt implementation instead of unsupported old one

py-bcrypt has been deprecated by bcrypt, and is no longer developed
or supported.

bcrypt requires bytestrings instead of strings, use safe_str to ensure
they're encoded before they're passed to bcrypt. Also, use check_pw
to minimise the number of manual conversions and comparisons.

Installation of bcrypt will probably compile a C extension and require
libffi-dev.

2 files changed with 4 insertions and 4 deletions:

kallithea/lib/auth.py

setup.py

0 comments (0 inline, 0 general)

kallithea/lib/auth.py

➞

Show inline comments

@@ @@ -52,7 +52,7 @@ from kallithea.model.db import User, Rep @@
     RepoGroup, UserGroupRepoGroupToPerm, UserIpMap, UserGroupUserGroupToPerm, \
     UserGroup, UserApiKeys
 from kallithea.lib.utils2 import safe_unicode, aslist
+from kallithea.lib.utils2 import safe_str, safe_unicode, aslist
 from kallithea.lib.utils import get_repo_slug, get_repo_group_slug, \
     get_user_group_slug, conditional_cache
 from kallithea.lib.caching_query import FromCache
@@ @@ -107,7 +107,7 @@ class KallitheaCrypto(object): @@
             return hashlib.sha256(str_).hexdigest()
         elif is_unix:
             import bcrypt
             return bcrypt.hashpw(str_, bcrypt.gensalt(10))
+            return bcrypt.hashpw(safe_str(str_), bcrypt.gensalt(10))
         else:
             raise Exception('Unknown or unsupported platform %s' \
                             % __platform__)
@@ @@ -126,7 +126,7 @@ class KallitheaCrypto(object): @@
             return hashlib.sha256(password).hexdigest() == hashed
         elif is_unix:
             import bcrypt
-            return bcrypt.hashpw(password, hashed) == hashed
+            return bcrypt.checkpw(safe_str(password), safe_str(hashed))
         else:
             raise Exception('Unknown or unsupported platform %s' \
                             % __platform__)

setup.py

➞

Show inline comments

@@ @@ -66,7 +66,7 @@ if sys.version_info < (2, 7): @@
     requirements.append("argparse")
 if not is_windows:
-    requirements.append("py-bcrypt>=0.3.0,<=0.4")
+    requirements.append("bcrypt>=2.0.0")
 dependency_links = [

0 comments (0 inline, 0 general)