Meishin/LoginSystem
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

#848 Prevent "invalid salt version" when hash format is clearly not BCrypt

Browse Source
This commit is contained in:
ljacqu
2016-08-13 20:10:38 +02:00
parent 58308cffb5
commit 7f3c308009
5 changed files with 27 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/fr/xephi/authme/security/crypts/BCRYPT.java
+2 -1
View File
@@ -1,6 +1,7 @@
package fr.xephi.authme.security.crypts;
import fr.xephi.authme.ConsoleLogger;
import fr.xephi.authme.security.HashUtils;
import fr.xephi.authme.security.crypts.description.HasSalt;
import fr.xephi.authme.security.crypts.description.Recommendation;
import fr.xephi.authme.security.crypts.description.SaltType;
@@ -36,7 +37,7 @@ public class BCRYPT implements EncryptionMethod {
@Override
public boolean comparePassword(String password, HashedPassword hash, String name) {
try {
return hash.getHash().length() > 3 && BCryptService.checkpw(password, hash.getHash());
return HashUtils.isValidBcryptHash(hash.getHash()) && BCryptService.checkpw(password, hash.getHash());
} catch (IllegalArgumentException e) {
ConsoleLogger.warning("Bcrypt checkpw() returned " + StringUtils.formatException(e));
}
src/main/java/fr/xephi/authme/security/crypts/IPB4.java
+2 -1
View File
@@ -1,6 +1,7 @@
package fr.xephi.authme.security.crypts;
import fr.xephi.authme.ConsoleLogger;
import fr.xephi.authme.security.HashUtils;
import fr.xephi.authme.security.RandomString;
import fr.xephi.authme.security.crypts.description.HasSalt;
import fr.xephi.authme.security.crypts.description.Recommendation;
@@ -34,7 +35,7 @@ public class IPB4 implements EncryptionMethod {
@Override
public boolean comparePassword(String password, HashedPassword hash, String name) {
try {
return hash.getHash().length() > 3 && BCryptService.checkpw(password, hash.getHash());
return HashUtils.isValidBcryptHash(hash.getHash()) && BCryptService.checkpw(password, hash.getHash());
} catch (IllegalArgumentException e) {
ConsoleLogger.warning("Bcrypt checkpw() returned " + StringUtils.formatException(e));
}
src/main/java/fr/xephi/authme/security/crypts/XFBCRYPT.java
+2 -1
View File
@@ -1,6 +1,7 @@
package fr.xephi.authme.security.crypts;
import fr.xephi.authme.ConsoleLogger;
import fr.xephi.authme.security.HashUtils;
import fr.xephi.authme.util.StringUtils;
import java.util.regex.Matcher;
@@ -29,7 +30,7 @@ public class XFBCRYPT implements EncryptionMethod {
@Override
public boolean comparePassword(String password, HashedPassword hash, String salt) {
try {
return hash.getHash().length() > 3 && BCryptService.checkpw(password, hash.getHash());
return HashUtils.isValidBcryptHash(hash.getHash()) && BCryptService.checkpw(password, hash.getHash());
} catch (IllegalArgumentException e) {
ConsoleLogger.warning("XfBCrypt checkpw() returned " + StringUtils.formatException(e));
}