forgejo-federation/models/user
Gusted 623c93ff46
Increase Salt randomness (#18179)
- The current implementation of `RandomString` doesn't give you a most-possible unique randomness. It gives you 6*`length` instead of the possible 8*`length` bits(or as `length`x bytes) randomness. This is because `RandomString` is being limited to a max value of 63, this in order to represent the random byte as a letter/digit.
- The recommendation of pbkdf2 is to use 64+ bit salt, which the `RandomString` doesn't give with a length of 10, instead of increasing 10 to a higher number, this patch adds a new function called `RandomBytes` which does give you the guarentee of 8*`length` randomness and thus corresponding of `length`x bytes randomness.
- Use hexadecimal to store the bytes value in the database, as mentioned, it doesn't play nice in order to convert it to a string. This will always be a length of 32(with `length` being 16).
- When we detect on `Authenticate`(source: db) that a user has the old format of salt, re-hash the password such that the user will have it's password hashed with increased salt.

Thanks to @zeripath for working out the rouge edges from my first commit 😄.

Co-authored-by: lafriks <lauris@nix.lv>
Co-authored-by: zeripath <art27@cantab.net>
2022-01-04 15:13:52 +00:00
..
avatar.go Move user related model into models/user (#17781) 2021-11-24 17:49:20 +08:00
email_address.go Move more model into models/user (#17826) 2021-11-28 22:11:58 +08:00
email_address_test.go Move more model into models/user (#17826) 2021-11-28 22:11:58 +08:00
error.go Move user related model into models/user (#17781) 2021-11-24 17:49:20 +08:00
external_login_user.go Add Option to synchronize Admin & Restricted states from OIDC/OAuth2 along with Setting Scopes (#16766) 2021-12-14 16:37:11 +08:00
follow.go Remove NewSession method from db.Engine interface (#17577) 2021-11-21 23:41:00 +08:00
follow_test.go Move user follow and openid into models/user/ (#17613) 2021-11-17 17:58:31 +08:00
list.go Refactor auth package (#17962) 2022-01-02 21:12:35 +08:00
main_test.go Move user related model into models/user (#17781) 2021-11-24 17:49:20 +08:00
openid.go Move user follow and openid into models/user/ (#17613) 2021-11-17 17:58:31 +08:00
openid_test.go Move user follow and openid into models/user/ (#17613) 2021-11-17 17:58:31 +08:00
redirect.go Move EmailAddress & UserRedirect into models/user/ (#17607) 2021-11-11 15:03:30 +08:00
redirect_test.go Decouple unit test code from business code (#17623) 2021-11-12 22:36:47 +08:00
search.go Move user related model into models/user (#17781) 2021-11-24 17:49:20 +08:00
setting.go Simplify parameter types (#18006) 2021-12-20 04:41:31 +00:00
setting_test.go Add user settings key/value DB table (#16834) 2021-11-22 04:47:23 -05:00
user.go Increase Salt randomness (#18179) 2022-01-04 15:13:52 +00:00
user_test.go Refactor auth package (#17962) 2022-01-02 21:12:35 +08:00