Matrix-Mirrors/anonymousland-synapse
1
0
Fork 0
mirror of https://git.anonymousland.org/anonymousland/synapse.git synced 2025-05-02 12:06:08 -04:00
Code Issues Projects Releases Packages Wiki Activity

Add pepper to password hashing

Browse source 
Signed-off-by: Kent Shikama <kent@kentshikama.com>
This commit is contained in:
Kent Shikama 2016-07-05 02:13:52 +09:00
parent 3de8168343
commit 8bdaf5f7af
No known key found for this signature in database
GPG key ID: D275958A0FA61427
2 changed files with 8 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

5
synapse/handlers/auth.py
View file

@ -750,7 +750,7 @@ class AuthHandler(BaseHandler):
Returns:
Hashed password (str).
"""
return bcrypt.hashpw(password, bcrypt.gensalt(self.bcrypt_rounds))
return bcrypt.hashpw(password + self.hs.config.password_config.pepper, bcrypt.gensalt(self.bcrypt_rounds))
def validate_hash(self, password, stored_hash):
"""Validates that self.hash(password) == stored_hash.
@ -763,6 +763,7 @@ class AuthHandler(BaseHandler):
Whether self.hash(password) == stored_hash (bool).
"""
if stored_hash:
return bcrypt.hashpw(password, stored_hash.encode('utf-8')) == stored_hash
return bcrypt.hashpw(password + self.hs.config.password_config.pepper,
stored_hash.encode('utf-8')) == stored_hash
else:
return False