Security Update - Githubissues

AndrewHocking / DanceConnect

MIT License

0 stars 0 forks source link

Security Update #108

Closed prabjot09 closed 6 months ago

prabjot09 commented 6 months ago

Changes:

Hashed passwords using bcrypt
- Updated password matching in routes/ui/people.py to account for password hashing.
Put configuration information in file: /instances/config.py
- Moved UPLOAD_FOLDER config from routes/ui/people.py to config file.
Added UI for password strength checking on sign-up and edit-person pages. Now requires the following:
- 8+ characters
- At least 1 of each:
- uppercase character
- lowercase character
- digit (0-9)
- Any other symbol (e.g. @, !, ?, ...)

prabjot09 commented 6 months ago

I can't test it without the config file, but just reading through the code it looks great! It would be a good idea to implement password salting as well, but that can be a separate task.

I think bcrypt handles salting as well since the password hashes are different for dummy users with the same password. I will confirm this tomorrow though to make sure.