Code cleanup, work exclusively with bcrypt, works on Windows

PhotoBackup / server-bottle

The Python PhotoBackup server implementation

https://photobackup.github.io/

GNU General Public License v2.0

36 stars 7 forks source link

Code cleanup, work exclusively with bcrypt, works on Windows #21

Open tminakov opened 7 years ago

tminakov commented 7 years ago

The changes can be summarized in two major areas:

the password checks are exclusively through bcrypt, thus mitigating timing attacks - inspired from the go implementation, done by @lupine
code cleanup and refactoring:
- all operations involving the config are now in the serverconfig.py (ex "init.py") file, separation of logic and purpose
- the server can be initialized/ran on Windows now - shortcuted the writability check done by pwd
- a couple of small bugss/corner cases covered

tminakov commented 7 years ago

Travis failed on py3.2, at the import of logbook and requests; this amazes me a lot (to put it mildly), and I'm not sure how shall that be fixed - and shall it at all.

tminakov commented 7 years ago

Hi @stephanepechard, any update of the merge, is there something bothering you with the code? I'd really like to see it in, to use as a base for some new development.

Thanks, Todor

stephanepechard commented 7 years ago

@tminakov Did you validate your changes on OSes other than Windows?

tminakov commented 7 years ago

Yes, on Ubuntu - my main dev environment, and Debian - my main execution one; the Windows' writability check skip is just "to get it done" and for compatibility - but I've tested it there also.

tminakov commented 7 years ago

By the way, I should've mentioned it - looked into the 3.2 failure, and it comes from the requests library - it does not support it, as a lot of others also don't:

https://github.com/requests/requests/issues/3479

https://github.com/requests/requests/issues/3507#issuecomment-239422977