PeL/force-orange-2022
PeL/force-orange-2022
1
1
Fork 0
mirror of https://github.com/Paris-est-Ludique/intranet.git synced 2025-06-08 08:34:20 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

Add support for passwords ending with a space

Browse Source
This commit is contained in:
pikiou 2022-10-29 01:47:44 +02:00
parent e6a049d0d1
commit b7490536dd
1 changed files with 20 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
src/server/gsheets/volunteers.ts
View File

@ -1,6 +1,7 @@
import path from "path" import path from "path"
import * as fs from "fs" import * as fs from "fs"
import { assign, cloneDeep, max, omit, pick } from "lodash" import { assign, cloneDeep, map, max, omit, pick, some } from "lodash"
// import { assign, cloneDeep, max, omit, pick } from "lodash"
import bcrypt from "bcrypt" import bcrypt from "bcrypt"
import sgMail from "@sendgrid/mail" import sgMail from "@sendgrid/mail"
@ -155,19 +156,27 @@ export const volunteerLogin = expressAccessor.get<VolunteerLogin>(async (list, b
throw Error("Il n'y a aucun bénévole avec cet email") throw Error("Il n'y a aucun bénévole avec cet email")
} }
// Try all password combinations with or without space after
const password = body.password || "" const password = body.password || ""
const password1Match = await bcrypt.compare( const passwords: string[] = [
password, password,
volunteer.password1.replace(/^\$2y/, "$2a") `${password} `,
password.replace(/ $/, ""),
password.replace(/\s+ $/, ""),
`${password.replace(/\s+ $/, "")} `,
]
const toTry = [
...map(passwords, (p) => [p, volunteer.password1]),
...map(passwords, (p) => [p, volunteer.password2]),
] as [string, string][]
const tries = await Promise.all(
map(toTry, async ([p, save]) => bcrypt.compare(p, save.replace(/^\$2y/, "$2a")))
) )
if (!password1Match) {
const password2Match = await bcrypt.compare( console.log("tries", JSON.stringify(tries))
password,
volunteer.password2.replace(/^\$2y/, "$2a") if (!some(tries)) {
) throw Error("Mauvais mot de passe pour cet email")
if (!password2Match) {
throw Error("Mauvais mot de passe pour cet email")
}
} }
const jwt = await getJwt(volunteer.id, volunteer.roles) const jwt = await getJwt(volunteer.id, volunteer.roles)