engineering/unrhodecode
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

security: limit the maximum password lenght to 72 characters to prevent possible

Browse source 
server side resource consumption attack.

- bcrypt heavy computation can lead to DOS using a very long password .eg 10**8 lenght.
- we allowed this on registration or on password update
This commit is contained in:
Marcin Lulek 2017-09-27 10:52:17 +02:00
parent 173061b9a5
commit d727c59e69
1 changed files with 7 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

13
rhodecode/model/forms.py
View file

@ -90,6 +90,7 @@ def LoginForm():
password = v.UnicodeString(
strip=False,
min=3,
max=72,
not_empty=True,
messages={
'empty': _(u'Please enter a password'),
@ -111,21 +112,21 @@ def UserForm(edit=False, available_languages=[], old_data={}):
if edit:
new_password = All(
v.ValidPassword(),
v.UnicodeString(strip=False, min=6, not_empty=False)
v.UnicodeString(strip=False, min=6, max=72, not_empty=False)
)
password_confirmation = All(
v.ValidPassword(),
v.UnicodeString(strip=False, min=6, not_empty=False),
v.UnicodeString(strip=False, min=6, max=72, not_empty=False),
)
admin = v.StringBoolean(if_missing=False)
else:
password = All(
v.ValidPassword(),
v.UnicodeString(strip=False, min=6, not_empty=True)
v.UnicodeString(strip=False, min=6, max=72, not_empty=True)
)
password_confirmation = All(
v.ValidPassword(),
v.UnicodeString(strip=False, min=6, not_empty=False)
v.UnicodeString(strip=False, min=6, max=72, not_empty=False)
)
password_change = v.StringBoolean(if_missing=False)
@ -207,11 +208,11 @@ def RegisterForm(edit=False, old_data={}):
)
password = All(
v.ValidPassword(),
v.UnicodeString(strip=False, min=6, not_empty=True)
v.UnicodeString(strip=False, min=6, max=72, not_empty=True)
)
password_confirmation = All(
v.ValidPassword(),
v.UnicodeString(strip=False, min=6, not_empty=True)
v.UnicodeString(strip=False, min=6, max=72, not_empty=True)
)
active = v.StringBoolean(if_missing=False)
firstname = v.UnicodeString(strip=True, min=1, not_empty=False)