Security/fix password hashing#890
Open
NathanGr33n wants to merge 10 commits into
Open
Conversation
Created: freeciv-proxy/password_utils.py - Bcrypt-based password hashing and verification with OWASP-recommended work factor of 12 - Automatic hash format detection (bcrypt vs legacy SHA-256) - Legacy SHA-256 verification for backward compatibility during migration - needs_upgrade() helper for transparent hash migration support
Modified: freeciv-proxy/freeciv-proxy.py - Replaced hashlib import with password_utils (verify_password, hash_password, needs_upgrade) - Refactored check_user to pass database connection for hash upgrade commits - Rewrote check_user_password to use bcrypt verification with legacy SHA-256 fallback - Added _upgrade_password_hash for transparent migration of legacy hashes to bcrypt on login - Fixed null safety in check_user finally block to prevent AttributeError on connection failure - Removed unused password parameter from SQL query binding
Modified: scripts/install/deb.sh - Added python3-bcrypt to Debian package dependency list for bcrypt password hashing in freeciv-proxy
Modified: freeciv-web/pom.xml - Added org.mindrot:jbcrypt:0.4 dependency for bcrypt password hashing
Created: freeciv-web/src/main/java/org/freeciv/util/PasswordUtil.java - Bcrypt password hashing with OWASP-recommended work factor of 12 - Multi-format verification supporting bcrypt, legacy SHA-256, and Unix crypt - Hash format auto-detection for transparent backward compatibility - upgradeHashIfNeeded() for best-effort migration of legacy hashes on login - Mirrors Python password_utils.py for consistent hashing across the stack
Modified: freeciv-web/src/main/java/org/freeciv/servlet/LoginUser.java - Replaced DigestUtils.sha256Hex comparison with PasswordUtil.verifyPassword - Added transparent hash upgrade to bcrypt on successful login - Removed unused DigestUtils import
Modified: freeciv-web/src/main/java/org/freeciv/servlet/NewPBEMUser.java - Replaced DigestUtils.sha256Hex with PasswordUtil.hashPassword for new account registration - Removed unused DigestUtils import
Modified: freeciv-web/src/main/java/org/freeciv/servlet/ResetPassword.java - Replaced Crypt.crypt with PasswordUtil.hashPassword for password reset storage - Removed unused Crypt import
Modified: freeciv-web/src/main/java/org/freeciv/servlet/DeactivateUser.java - Replaced Crypt.crypt verification with PasswordUtil.verifyPassword - Removed unused Crypt import
Modified: freeciv-web/src/main/java/org/freeciv/servlet/DeleteSaveGame.java - Replaced DigestUtils.sha256Hex comparison with PasswordUtil.verifyPassword - Added transparent hash upgrade to bcrypt on successful authentication - Removed unused Crypt and DigestUtils imports
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Upgraded legacy hash formats to bcrypt.
Files Changed:
freeciv-proxy/freeciv-proxy.py
freeciv-web/pom.xml
freeciv-web/src/main/java/org/freeciv/servlet/DeactivateUser.java
freeciv-web/src/main/java/org/freeciv/servlet/DeleteSaveGame.java
freeciv-web/src/main/java/org/freeciv/servlet/LoginUser.java
freeciv-web/src/main/java/org/freeciv/servlet/NewPBEMUser.java
freeciv-web/src/main/java/org/freeciv/servlet/ResetPassword.java
scripts/install/deb.sh
Files Added:
freeciv-proxy/password_utils.py
freeciv-web/src/main/java/org/freeciv/util/PasswordUtil.java