Add SMF 2.1 support to the SMF 2.0 authenticator - Githubissues

mumble-voip / mumble-scripts

Mumble scripts is a place for gathering various scripts written for the Mumble VoIP application.

https://www.mumble.info

48 stars 33 forks source link

Add SMF 2.1 support to the SMF 2.0 authenticator #27

Closed webgeek1234 closed 4 years ago

davidebeatrici commented 4 years ago

Thank you very much for your contribution!

Kissaki commented 3 years ago

@webgeek1234 Was this tested and does this work for you??

The SMF 2.1 check doesn’t make sense to me.

Rather than a known salt from the database it uses the target hash to compare against. This seems wrong.
It uses hashpw when it should use checkpw

Maybe you can explain the thought or concept behind this logic?

Kissaki commented 3 years ago

@davidebeatrici What was your context for approving this? How deep did you verify? Just a look of unknown code, or knowing or checking methods and how they are used? I presume no test?

Kissaki commented 3 years ago

How does SMF 2.1 handle existing accounts? When are passwords bcrypt vs sha1 on a 2.1 installation?

Kissaki commented 3 years ago

I’m not too familiar with the python landscame. Can you point me to/tell me where/if there is a reference documentation for the hashpw function? I would like to know in what cases the exception is thrown.

webgeek1234 commented 3 years ago

I am actively using this on a public install. I based it on the mediawiki integration module while also referencing smf directly. It's been a while since I wrote the code, so I don't remember the specifics. SMF switched to bcrypt for 2.1, but we have to account for people that haven't logged into the forum post-upgrade and still have the old hash method.

Kissaki commented 3 years ago

Okay, I guess I will have to test it on an instance to understand it…