r9914 - in apps/gobi/trunk/code: Global Page User

Author: hannes
Date: 2009-09-17 11:41:21 +0200 (Thu, 17 Sep 2009)
New Revision: 9914

Modified:
   apps/gobi/trunk/code/Global/Global.js
   apps/gobi/trunk/code/Global/Startup.js
   apps/gobi/trunk/code/Page/PageActions.js
   apps/gobi/trunk/code/Page/PageCore.js
   apps/gobi/trunk/code/User/User.js
Log:
Completely switch to secure password handling, and give some care to autologin.

Details at http://dev.helma.org/trac/helma/changeset/9914

Modified: apps/gobi/trunk/code/Global/Global.js
===================================================================
--- apps/gobi/trunk/code/Global/Global.js	2009-09-16 21:08:59 UTC (rev 9913)
+++ apps/gobi/trunk/code/Global/Global.js	2009-09-17 09:41:21 UTC (rev 9914)
@@ -381,9 +381,16 @@
 /**
  * Set auto-login cookie
  */
-function setAutoLoginCookie(name, token) {
-    var cookie = name + "/" + (token + req.data.http_remotehost).md5();
-    res.setCookie("gobi_autologin", cookie, 365);
+function setAutoLoginCookie() {
+    if (session.user) {
+        var name = session.user.name,
+            hash = session.user.getFormData().password_hash,
+            host = req.data.http_remotehost;
+        if (hash) {
+            var cookie = name + "/" + (hash + host).md5();
+            res.setCookie("gobi_autologin", cookie, 365);
+        }
+    }
 }
 
 /**
@@ -401,15 +408,15 @@
         return;
     var cookie = req.data.gobi_autologin.split("/");
     var user = getUser(cookie[0]);
-    if (!user)
-        return;
-    var formdata = user.getFormData();
-    if (!formdata.password && !formdata.password_hash)
-        return;
-    var hash = ((formdata.password_hash || formdata_password) + req.data.http_remotehost).md5();
-    if (hash == cookie[1]) {
-        res.message = msg("login_succeeded", root.name, user.name);
-        session.login(user);
+    if (user) {
+        var hash = user.getFormData().password_hash,
+            host = req.data.http_remotehost;
+        if (hash && host && (hash + host).md5() == cookie[1]) {
+            res.message = msg("login_succeeded", root.name, user.name);
+            session.login(user);
+            // refresh autologin cookie
+            res.setCookie("gobi_autologin", req.data.gobi_autologin, 365);
+        }
     }
 }
 

Modified: apps/gobi/trunk/code/Global/Startup.js
===================================================================
--- apps/gobi/trunk/code/Global/Startup.js	2009-09-16 21:08:59 UTC (rev 9913)
+++ apps/gobi/trunk/code/Global/Startup.js	2009-09-17 09:41:21 UTC (rev 9914)
@@ -37,9 +37,15 @@
     try {
         convertAttachments();
     } catch (x) {
-        app.logger.error("Caught in convertAttachments: " + x);
+        app.logger.error("Error in convertAttachments: " + x);
     }
 
+    try {
+        convertPasswords();
+    } catch (x) {
+        app.logger.error("Error in convertPasswords: " + x);
+    }
+
     for (var i = 0; i < gobi.pages.length; i++) {
         registerPage(root, gobi.pages[i]);
     }
@@ -176,3 +182,30 @@
     });
     p.start(root);
 }
+
+function convertPasswords() {
+    var users = getService("users");
+    var converted = 0;
+    if (users) {
+        users.prefetchChildren();
+        var list = users.list();
+        for each (user in list) {
+            var data = user.getFormData();
+            if (data.password_salt && data.password_hash) {
+                continue;
+            }
+            app.log("Converting password for user " + user.name);
+            converted++;
+            var rnd = java.security.SecureRandom.getInstance("SHA1PRNG");
+            var password = data.password || "";
+            var salt = data.password_salt = rnd.nextLong().toString(36);
+            data.password_hash = (salt + password).md5();
+            delete data.password;
+            user.setFormData(data);
+        }
+    }
+    if (converted > 0) {
+        app.log("Converted " + converted + " user passwords");
+        res.commit();
+    }
+}

Modified: apps/gobi/trunk/code/Page/PageActions.js
===================================================================
--- apps/gobi/trunk/code/Page/PageActions.js	2009-09-16 21:08:59 UTC (rev 9913)
+++ apps/gobi/trunk/code/Page/PageActions.js	2009-09-17 09:41:21 UTC (rev 9914)
@@ -596,17 +596,17 @@
         res.data.body = "User Service is not configured. Can't login.";
     } else {
         if (req.data.login) {
-            var user = users.get(req.data.name);
-            var formdata = user && user.getFormData();
-            if (formdata && (formdata.password == req.data.password ||
-                    (formdata.password_salt + req.data.password).md5() == formdata.password_hash)) {
+            var user = users.get(req.data.name),
+                data = user && user.getFormData(),
+                salt = data && data.password_salt,
+                hash = data && data.password_hash,
+                password = req.data.password;
+            if (salt && hash && password != null && String(salt + password).md5() == hash) {
                 session.login(user);
-                setAutoLoginCookie(user.name, formdata.password_hash || formdata.password);
+                setAutoLoginCookie();
                 res.message = msg("login_succeeded", root.name, user.name);
-                var location = session.data.lastLocation;
+                var location = session.data.lastLocation || this.href();
                 session.data.lastLocation = null;
-                if (!location)
-                    location = this.href(); 
                 res.redirect(location);
             } else {
                 res.message = msg("login_failed");
@@ -677,7 +677,7 @@
                     // if current user is not logged in, log in as new user
                     if (!session.user) {
                         session.login(it);
-                        setAutoLoginCookie(it.name, req.data.password);
+                        setAutoLoginCookie();
                         res.message += msg("register_welcome");
                     }
                     res.redirect(this.href());

Modified: apps/gobi/trunk/code/Page/PageCore.js
===================================================================
--- apps/gobi/trunk/code/Page/PageCore.js	2009-09-16 21:08:59 UTC (rev 9913)
+++ apps/gobi/trunk/code/Page/PageCore.js	2009-09-17 09:41:21 UTC (rev 9914)
@@ -838,9 +838,9 @@
     
     var size = param && param.size != null ? param.size : 40;
     var name = "formdata[" + field.name + "]";
+    var label = param && param.label != null ? param.label : field.label;
 
     function writeLabel() {
-        var label = param && param.label != null ? param.label : field.label;
         res.write("<p style=\"clear: both;\">");
         res.write("<div>")
         res.write(label);

Modified: apps/gobi/trunk/code/User/User.js
===================================================================
--- apps/gobi/trunk/code/User/User.js	2009-09-16 21:08:59 UTC (rev 9913)
+++ apps/gobi/trunk/code/User/User.js	2009-09-17 09:41:21 UTC (rev 9914)
@@ -66,6 +66,9 @@
             this.modifier = session.user;
             this.modifytime = new Date();
             res.message = msg("password_change_confirm");
+            if (session.user == this) {
+                setAutoLoginCookie();
+            }
             res.redirect(this.href());
         }
     }