search

gathering / wannabe

Event-system for TG - wannabe.gathering.org
GNU General Public License v3.0
12 stars 7 forks source link

Fix issue where we checked cookie password-hash as a password #43

Closed niccofyren closed 4 years ago

niccofyren commented 4 years ago

When improving password security we inadvertently broke the change event functionality built into AuthComponent, by checking pass key as a normal password input. Turns out this is actually the raw password hash, not a password string.

The updated version checks password hash from session against password hash from user model as before. Also changes changes names from pass and password too passwordHash to make things a bit more obvious.

A quick fix for this is live in the current app, but not in a persistent fashion. So suggest we merge this sooner rather than later 😅

olemathias commented 4 years ago

Looks like this fix breaks normal login. Reverted the line if(!$this->User->correctPassword($userGoingIn, $pass)) { in prod

niccofyren commented 4 years ago

Ok. Will keep looking into this this evening then

niccofyren commented 4 years ago

Think the bug has been fixed now. With the latest commit both regular login, and the "login" that happens during event change should work.

mfyll commented 4 years ago

Great stuff