172 Commits

Author SHA1 Message Date
HaHaWTH
9c3f0b0142 Fixed Issue #35 2023-10-01 20:52:59 +08:00
HaHaWTH
3f6a7ce48f Sync repo files to b22 2023-09-20 02:15:22 +08:00
HaHaWTH
ed320196fe Remove all files 2023-09-20 02:10:19 +08:00
HaHaWTH
7e49e26735 reupload files 2023-07-11 20:45:01 +08:00
HaHaWTH
b014da245d Del all files 2023-07-11 20:42:24 +08:00
Sabrita
674d72c113 优化 import 。更改默认配置 2023-02-28 12:36:56 +08:00
Gabriele C
75b3a571e1 Always specify Locale on toLowerCase and toUpperCase usages, fixes AuthMe not working correctly on machines with turkish locale. ('I'.toLowerCase() => 'ı') 2022-08-20 04:41:04 +02:00
ljacqu
c34f00f759 #1874 Introduce individual ConsoleLogger instance per class (#1875)
* #1874 Introduce individual ConsoleLogger instance per class
- Create ConsoleLoggerFactory from which a separate logger can be created for each class
- Allows to support individual log level settings in the future

* Fix CodeStyle issue

* Replace full class name with import

* Update usages after merge from master
2019-08-06 15:15:16 +02:00
ljacqu
f0d3d085c6 #1574 Use server name in 2FA QR code link instead of IP 2019-08-02 15:38:13 +02:00
ljacqu
210a4f61cb #1219 Make 2FA tokens one-use only (#1848)
- Make TotpAuthenticator keep track of the used codes and reject any known ones
2019-07-06 18:26:43 +02:00
ljacqu
b22f26822b
#1627 Replace BCryptService with Maven dependency (#1629)
* #1627 Replace BCryptService with Maven dependency
- Remove BCryptService in favor of a better BCrypt implementation (Maven dependency)
- Introduce BCryptHasher wrapping the dependency with more suitable methods
- Fix inaccurate details about salt length in docu annotation: for BCrypt it's always 22 chars
- Change phpBB hash to produce 2y hashes instead of 2a

* #1627 Use UTF-8 encoding when (dis)assembling Strings

* #1627 Small test additions
2018-09-03 23:13:48 +02:00
ljacqu
f79c364f84 Minor fixes as reported by CodeClimate 2018-09-01 09:17:42 +02:00
Gabriele C
da7e7edc37
Fix messaging [WIP] (#1614)
* Fix messaging [WIP]

* Make codeclimate happy

* Codeclimate, pls

* got it, i hope

* Improvements

* Remove duplicated checks, other improvements, make login/logout broadcasts

* Optimize project imports

* Make codeclimate happy again
2018-08-26 15:29:47 +02:00
ljacqu
8e4288f911 Minor code householding 2018-05-20 13:10:26 +02:00
ljacqu
6f2f7a73af Merge branch 'master' of https://github.com/AuthMe/AuthMeReloaded into 1141-optional-additional-2fa-auth 2018-05-01 22:49:23 +02:00
ljacqu
1e3ed795c1 #1141 2FA implementation fixes
- Merge TotpService into TotpAuthenticator
- Add missing tests
- Migrate old 2fa enabled key to new one
2018-05-01 22:49:07 +02:00
ljacqu
d55b4bb3b5 #1561 Fix timing attacks by comparing hashes in constant time (#1563)
* #1561 Fix timing attacks by comparing hashes in constant time

* #1561 Fix timing attacks in phpBB fallback hashes
- As noted by @games647
2018-04-22 21:27:38 +02:00
ljacqu
ecaffbabfc Small cleanups / changes amassed over time
- Small javadoc fixes
- Simplifications
- Move logException method from StringUtils to ExceptionUtils
2018-04-22 12:45:34 +02:00
ljacqu
29ac3a7022 #1141 Fixes to TOTP implementation
- Revert back to SHA1 as HMAC hash function so that it works with Google authenticator
- Add message to user to tell him to run /2fa confirm to add a TOTP code
2018-04-22 11:13:27 +02:00
ljacqu
9326094d9c #1141 Fix review remarks by @games647
- Use SHA512 to generate keys instead of default SHA1
- Declare google authenticator dependency as optional and add relocation rule
2018-04-03 00:13:53 +02:00
ljacqu
e9ab82db6b #1141 Make 2fa messages translatable, various cleanups (null safety, ...) 2018-03-21 23:56:13 +01:00
ljacqu
eb9cd31a65 #1141 Split TOTP permissions for add/remove, refactor TOTP services
- Split TotpService further into GenerateTotpService and TotpAuthenticator, which wraps the GoogleAuthenticator impl
- Add missing tests for the services
- Change GenerateTotpService's interface to behave like a collection for more intuitive method behavior
2018-03-10 16:21:53 +01:00
ljacqu
c3cf9e3ee0 #1141 Rough version of TOTP commands to add and remove a code for a player 2018-03-07 20:11:53 +01:00
Thibaut DAVID
2d77f54695 Add new hash method (#1446)
Add new hash method for a CMS : http://craftmywebsite.fr/
2017-12-07 19:58:19 +01:00
ljacqu
058ac22462 Update docs 2017-12-01 19:16:49 +01:00
ljacqu
7932c1bf90 Update to injector 1.0
- Includes Factory and SingletonStore so our custom implementation is removed
2017-11-25 21:27:18 +01:00
ljacqu
5c40cb3b73 Insert null email as DEFAULT so column default may take effect
Ugly implementation to fit into AuthMe 5.4. If email on PlayerAuth is null, do not supply NULL as the email value but use DEFAULT instead so that the default value is used if present in the column configuration.
2017-11-04 11:29:21 +01:00
ljacqu
80ab41ae5a #1400 Sync AuthMe's phpBB hash implementation with phpBB3's
- phpBB3 seems to favor using BCrypt $2y$ now
- Keep unsalted MD5 and phpass salted MD5 comparisons for backwards compatibility
2017-11-04 09:58:51 +01:00
games647
316f8fc642 Fix Java 9 support for Pbkdf2Django (#1390)
* Replace DatatypeConverter in Pbkdf2Django to support Java 9

* Fix NPE in AuthMeInitializer and CastException in Recovery tests

* Set logger for SetPasswordTest to prevent NPE on logging

* Use TestHelper for initializing ConsoleLogger
2017-10-29 12:11:24 +01:00
Alexandre Vanhecke
8fe92da119 #1150 - Add Argon2 support
- Add argon2 implementation

- Extract argon2 library check to method on Argon 2
- Add link to Wiki page on errors
- Check within Argon2Test if the test cases should be run, not in the abstract parent
2017-10-23 00:10:48 +02:00
ljacqu
b211c97395 Minor: delete PlainText implementation
- It never gets used anymore and could cause security issues if we did accidentally use it as EncryptionMethod
2017-10-22 09:27:03 +02:00
ljacqu
fca77b940f #1016 Deprecate MD5, SHA1, SHA512: no longer allowed for active use
- Deprecate unsalted hashes: if such a hash is configured, move it to the legacy hashes setting to still support the existing hashes in the database but hash all passwords from now on with our default, SHA256.
2017-10-19 21:30:19 +02:00
ljacqu
5be3f8facc #1095 Update SMF hash algorithm to generate salt as SMF does
- The salt isn't used for password hashing but SMF requires that there be one to generate the authentication cookie. This does not yet enable registration from Minecraft: SMF has other non-null columns that need to be tackled. This is a first step.
2017-10-08 22:42:37 +02:00
ljacqu
f88350b06d Fix Checkstyle violations
- Mostly missing Javadoc on large methods
- CommandInitializer: split command building method into multiple methods
2017-07-16 23:07:13 +02:00
timvisee
cae29a2f99 Revert "Implement ARGON2 hash (#1165)" due to an unwanted added binary.
This reverts commit bf387827907c482b0ee50be6735ad10c1a3a6c50.
2017-06-01 13:06:15 +02:00
ljacqu
c803822fa8 #1188 Create and keep encryption method instance (#1191)
- Avoid creating the same object over and over; instead keep it and only change it on settings reload
2017-04-30 17:41:51 +02:00
ljacqu
d0dbc14358 Minor - fix some small todo's 2017-04-23 11:02:43 +02:00
Gabriele C
bf38782790 Implement ARGON2 hash (#1165)
* Implement ARGON2 hash

#1150

* Fix argon hash verify

* Add argon2 test

* #1150 Account for Argon2 managing salts internally
2017-04-14 18:03:27 +02:00
ljacqu
c54231b255 #1138 Show warning for hashes that will be deprecated in 5.4
- Introduce Usage.DEPRECATED to mark the hash algorithms accordingly
- Log warning when such a deprecated hash algorithm is used
- Update hash algorithms doc page
2017-03-25 00:23:54 +01:00
ljacqu
8f197bbebf #1128 Rename converter classes to start with uppercase letter 2017-03-17 19:28:40 +01:00
ljacqu
6bd0b7c4e0 #1128 Rename files to match new case of Java classes 2017-03-17 19:21:20 +01:00
ljacqu
8ebb3c6b5a Merge branch 'master' of https://github.com/AuthMe/AuthMeReloaded into 1128-camel-case-rename 2017-03-17 18:50:57 +01:00
ljacqu
731d085ccd #1128 Rename to camel case (PR #235)
* rename classes according to cammel case and make code reflect these updates

* rename according to cammel case

* rename to camel case more accuratley

* rename to camel case try 3; fix Ipb4 java doc

* retry rename camel case

* rename to camel case
2017-03-17 18:49:30 +01:00
ljacqu
8aa573b9ed Minor fixes as found by Checkstyle 2017-03-05 10:58:29 +01:00
ljacqu
d2fccdeb80 Update Injector and create injectable object factory
- Using e.g. Factory<Converter> instead of the injector directly makes its purpose more specific and disallows any future abuse of the injector's functions
2017-02-05 16:52:35 +01:00
ljacqu
d717f75bb4 #1014 Use ConfigMe improvements to create custom Enum set property 2016-12-23 23:51:23 +01:00
ljacqu
79a3858b29 #685 Allow to configure number of rounds for PBKDF2 2016-11-26 18:41:04 +01:00
ljacqu
122c6586bc #685 Add php implementation for PBKDF2
- Create php sample for PBKDF2
- Rename pbkdf2 java classes (remove Crypt prefix)
- Remove options from hash setting comment that should not be used
2016-11-25 16:41:55 +01:00
ljacqu
de5324bbc6 #685 Fix PBKDF2 implementation
- Fix our PBKDF2 hash implementation and its test class
- Use external dependency as PBKDF2 implementation
2016-11-25 15:51:15 +01:00
ljacqu
d2a28bdaed #850 Fix export of legacy hashes property
- Ugly workaround due to #1014: need to have EnumSetProperty extend from StringListProperty type so that it is exported in a proper manner (as a string list). To get an enum Set we need to call a dedicated method on EnumSetProperty for the time being.
2016-11-22 22:02:34 +01:00