Re: How to require stronger passwords for Roundup (1.5.1)

On 31/01/17 16:30, John P. Rouillard wrote:
> In message <[email protected]>,
> "Hancock, David (DHANCOCK)" writes:
>
...
>
> No, I don't think you are missing anything. I am wonding if it's
> possible to provide the unhashed password to the auditor somehow.
>
..
>
> I'll try to trace the code and see what can be done. I have a feeling
> I may need to add a hook before the auditor code is invoked.
>
> I am also going to raise this on roundup-dev since it seems we have
> to do some core code changes.

Wouldn't it be enough to inherit from the RegisterAction class, similar 
to the customization example of LDAPLogin? where the LoginAction is 
inherited and the new subclass is registered as 'login'.

http://www.roundup-tracker.org/cgi-bin/moin.cgi/LDAPLogin2

The password check would be far more easier to implement then the LDAP 
authentication.

>
> Another (less secure) way to skin this cat would be to add some
> javascript to the password setting page and validate it client
> side. YMMV, not recommended that you try this at home, server side
> validation rules etc. etc....
>

Mhm... how would an attack be crafted on the assumption that you can 
inject an insecure password into the PBKDF2 encryption of roundup?

Anyways, server side validation would require a two step process (if not 
deriving the Login class.

1. The template where a new user is created () is changed to call a
    "verifyLogin" action first, which might use the same or a different
    template.

2. The verifyLogin action checks the password (still in the clear) and
    eventually other data (username already exists, duplicate Email, ...
    and
    - either proceeds to the normal roundup 'register' action or

    - sets self.client._error_message which makes the error message
      inside this nice red textbox appear on top of the page.

The setup of such a process, including a link to a step by step example
is documented in:

http://roundup-tracker.org/docs/customizing.html#defining-new-web-actions


Best Regards,

   Georg Lehner


------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, SlashDot.org! http://sdm.link/slashdot