Re: How to require stronger passwords for Roundup (1.5.1)
"John P. Rouillard" <[email protected]>
| Newsgroups | gmane.comp.bug-tracking.roundup.user |
|---|---|
| Message-ID | <[email protected]> |
In message <[email protected]>, "Hancock, David (DHANCOCK)" writes: >Thank you the ideas on this thread. The idea of writing an >auditor/reactor to check the passwords was the most appealing >initially, but I ran into a problem. By the time userauditor gets to >see the password from newvalues['password'] it's already been hashed: > >{PBKDF2}10000$GeodPG9LmZAwMCRrv79u7oVTHyg$ZYZaios16Kiq4wYB4zHHV1Lo00Q Crud, I was worried that may be the case. That makes sense since you are seeing the data that would be commited to the db. Hence hashed. >Is there something I'm missing here? The userauditor.py approach fits >my (small) brain. No, I don't think you are missing anything. I am wonding if it's possible to provide the unhashed password to the auditor somehow. >The other ideas were about connecting other authentication systems >instead of using Roundup's, but we're trying to eliminate dependency >on another system, and we've got everybody's information in Roundup >already. Fair enough. I'll try to trace the code and see what can be done. I have a feeling I may need to add a hook before the auditor code is invoked. I am also going to raise this on roundup-dev since it seems we have to do some core code changes. Another (less secure) way to skin this cat would be to add some javascript to the password setting page and validate it client side. YMMV, not recommended that you try this at home, server side validation rules etc. etc.... -- -- rouilj John Rouillard =========================================================================== My employers don't acknowledge my existence much less my opinions. ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, SlashDot.org! http://sdm.link/slashdot