From 1dd495ec918979a80fcefceee5e74971d274a439 Mon Sep 17 00:00:00 2001 From: NathanBdnt Date: Wed, 31 Jan 2024 10:17:56 +0100 Subject: [PATCH 1/2] =?UTF-8?q?Passage=20de=20SHA1=20=C3=A0=20SHA256?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- desk.js | 35 ++++++++++++++++++++++++++--------- 1 file changed, 26 insertions(+), 9 deletions(-) diff --git a/desk.js b/desk.js index e0b10e36..3dacb2b6 100644 --- a/desk.js +++ b/desk.js @@ -13,6 +13,7 @@ const actions = require( 'desk-base' ), path = require( 'path' ), pty = require( 'node-pty' ), socketIO = require( 'socket.io' ); +const { test } = require('shelljs'); const certificateFile = path.join( __dirname, "certificate.pem" ), deskDir = actions.getRootDir(), @@ -31,11 +32,27 @@ actions.include( __dirname + '/extensions' ); function authenticate ( user, pass ) { if ( id.username === undefined ) return true; - const shasum = crypto.createHash( 'sha1' ); - shasum.update( pass ); - const sha = shasum.digest( 'hex' ); - if ( !user || !pass || user !== id.username || sha !== id.sha ) throw new Error( 'bad auth' ); - + const pass256 = pass; + const shasum256 = crypto.createHash( 'sha256' ); + shasum256.update(pass256); + const sha256 = shasum256.digest( 'hex' ); + + if ( id.sha) { + const pass1 = pass; + const shasum1 = crypto.createHash( 'sha1' ); + shasum1.update( pass1 ); + const sha1 = shasum1.digest( 'hex' ); + id.sha256 = sha256; + if ( !user || !pass || user !== id.username || sha1 !== id.sha ) { throw new Error( 'bad auth' );} + else if (user && pass && user == id.username && sha1 == id.sha) { + delete id.sha; + fs.writeFileSync( passwordFile, JSON.stringify( id ) ); + }; + } else { + if ( !user || !pass || user !== id.username || sha256 !== id.sha256 ) { throw new Error( 'bad auth' )}; + } + + } const app = express() @@ -182,9 +199,9 @@ function updatePassword() { if ( id.password ) { // convert to secure format - const shasum = crypto.createHash( 'sha1' ); + const shasum = crypto.createHash( 'sha256' ); shasum.update( id.password ); - id.sha = shasum.digest( 'hex' ); + id.sha256 = shasum.digest( 'hex' ); delete id.password; fs.writeFileSync( passwordFile, JSON.stringify( id ) ); @@ -219,9 +236,9 @@ io.on( 'connection', socket => { .on( 'setEmitLog', log => actions.setEmitLog( log ) ) .on( 'password', password => { - const shasum = crypto.createHash( 'sha1' ); + const shasum = crypto.createHash( 'sha256' ); shasum.update( password ); - id.sha = shasum.digest( 'hex' ); + id.sha256 = shasum.digest( 'hex' ); fs.writeFileSync( passwordFile, JSON.stringify( id ) ); } ); From fbdc28bc9442bdc0abb3b0a788c8ed2fdb3d2a77 Mon Sep 17 00:00:00 2001 From: NathanBdnt Date: Wed, 31 Jan 2024 10:53:42 +0100 Subject: [PATCH 2/2] =?UTF-8?q?Passage=20de=20Sha-1=20=C3=A0=20Sha-256?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- desk.js | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/desk.js b/desk.js index 3dacb2b6..97167775 100644 --- a/desk.js +++ b/desk.js @@ -37,17 +37,20 @@ function authenticate ( user, pass ) { shasum256.update(pass256); const sha256 = shasum256.digest( 'hex' ); + //If the hash of the password is calculated with SHA-1 then we change it if ( id.sha) { const pass1 = pass; const shasum1 = crypto.createHash( 'sha1' ); shasum1.update( pass1 ); const sha1 = shasum1.digest( 'hex' ); - id.sha256 = sha256; if ( !user || !pass || user !== id.username || sha1 !== id.sha ) { throw new Error( 'bad auth' );} + // We verify that the logins are correct before deleting and addind the hash 256 else if (user && pass && user == id.username && sha1 == id.sha) { delete id.sha; + id.sha256 = sha256; fs.writeFileSync( passwordFile, JSON.stringify( id ) ); }; + // } else { if ( !user || !pass || user !== id.username || sha256 !== id.sha256 ) { throw new Error( 'bad auth' )}; }