mirror/cherrypick
1
1
Fork 0
mirror of https://github.com/kokonect-link/cherrypick synced 2024-11-23 22:56:53 +09:00
Code

upd: rehash misskey passwords with argon2 on login

Browse Source
This commit is contained in:
Mar0xy 2023-09-27 21:46:56 +02:00 committed by Kitty Cat
parent 68d5487df2
commit 1da00235ab
No known key found for this signature in database
GPG Key ID: 5DD88428CF598F42
1 changed files with 14 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
packages/backend/src/server/api/SigninApiService.ts
View File

@ -4,7 +4,7 @@
*/
import { Inject, Injectable } from '@nestjs/common';
//import bcrypt from 'bcryptjs';
import bcrypt from 'bcryptjs';
import * as argon2 from 'argon2';
import * as OTPAuth from 'otpauth';
import { IsNull } from 'typeorm';
@ -124,7 +124,7 @@ export class SigninApiService {
const profile = await this.userProfilesRepository.findOneByOrFail({ userId: user.id });
// Compare password
const same = await argon2.verify(profile.password!, password);
const same = await argon2.verify(profile.password!, password) || bcrypt.compareSync(password, profile.password!);
const fail = async (status?: number, failure?: { id: string }) => {
// Append signin history
@ -141,6 +141,12 @@ export class SigninApiService {
if (!profile.twoFactorEnabled) {
if (same) {
if (profile.password!.startsWith('$2')) {
const newHash = await argon2.hash(password);
this.userProfilesRepository.update(user.id, {
password: newHash
});
}
return this.signinService.signin(request, reply, user);
} else {
return await fail(403, {
@ -157,6 +163,12 @@ export class SigninApiService {
}
try {
if (profile.password!.startsWith('$2')) {
const newHash = await argon2.hash(password);
this.userProfilesRepository.update(user.id, {
password: newHash
});
}
await this.userAuthService.twoFactorAuthenticate(profile, token);
} catch (e) {
return await fail(403, {