mirrors/etherpad-lite
1
0
Fork 0
mirror of https://github.com/ether/etherpad-lite.git synced 2025-05-05 06:37:10 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Modified the authentication stuff to grant access not based on plain password authentication but on a kind of 'timed cookies' so the password is not stored in plain text in some browser cookie.

Browse source 
Also modded some random string generation funtions for elegance.
This commit is contained in:
jaseg 2011-11-09 23:53:00 +01:00
parent 4fc4a35381
commit 082c732429
3 changed files with 39 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

9
node/db/SecurityManager.js
View file

@ -51,6 +51,7 @@ exports.checkAccess = function (padID, sessionID, token, password, callback)
var groupID = padID.split("$")[0];
var padExists = false;
var validSession = false;
var pwsalt;
var sessionAuthor;
var tokenAuthor;
var isPublic;
@ -131,6 +132,9 @@ exports.checkAccess = function (padID, sessionID, token, password, callback)
//is it password protected?
isPasswordProtected = pad.isPasswordProtected();
//get the password salt used by the hash function
pwsalt = pad.getPasswordSalt();
//is password correct?
if(isPasswordProtected && password && pad.isCorrectPassword(password))
@ -162,13 +166,14 @@ exports.checkAccess = function (padID, sessionID, token, password, callback)
else if(isPasswordProtected && passwordStatus == "wrong")
{
//--> deny access, ask for new password and tell them that the password is wrong
statusObject = {accessStatus: "wrongPassword"};
//The salt can be safely shared since it is not secret. It does its job (improving resistence against rainbow table attacks) even when public.
statusObject = {accessStatus: "wrongPassword", passwordSalt: pwsalt};
}
//- the pad is password protected but no password given
else if(isPasswordProtected && passwordStatus == "notGiven")
{
//--> ask for password
statusObject = {accessStatus: "needPassword"};
statusObject = {accessStatus: "needPassword", passwordSalt: pwsalt};
}
else
{