Marc/server
1
0
Fork 0
forked from github/server
Code Issues Pull requests Projects Releases Wiki Activity

do not fail on malformed passwords

Browse source
This commit is contained in:
Enno Rehling 2019-02-28 10:32:08 +01:00 committed by Enno Rehling
parent d122ba22d0
commit e24ebd7cbd
1 changed files with 6 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
process/epasswd.py
View file

@ -69,7 +69,12 @@ class EPasswd:
def check(self, id, passwd): def check(self, id, passwd):
pw = self.get_passwd(id) pw = self.get_passwd(id)
if pw[0:4]=='$2a$' or pw[0:4]=='$2y$': if pw[0:4]=='$2a$' or pw[0:4]=='$2y$':
return bcrypt.checkpw(passwd.encode('utf8'), pw.encode('utf8')) try:
h1 = pw.encode('utf8')
h2 = passwd.encode('utf8')
return bcrypt.checkpw(h1, h2)
except:
return False
return pw == passwd return pw == passwd
def get_passwd(self, id): def get_passwd(self, id):