rfaulkner / wikipedia_user_metrics

Wikimedia Foundation E3 Team Analysis Code
Other
9 stars 5 forks source link

API. Salt the passwords in db1047.prod.api_user #66

Closed rfaulkner closed 11 years ago

rfaulkner commented 11 years ago

These passwords shouldn't be stored in plain text.

rfaulkner commented 11 years ago

https://github.com/rfaulkner/E3_analysis/commit/930e86067d626e38c4b2e1b2846986eda6b51c9e

rfaulkner commented 11 years ago

A simple script to utilize this method, we probably want to use this with the api_user.password field.


#!/usr/bin/python
# -*- coding: utf-8 -*-

from user_metrics.utils import salt_string
import argparse
import sys

def parse_args():

    parser = argparse.ArgumentParser(
        description="This script salts an input string.",
        conflict_handler="resolve",
        usage = "./get_salted_string <string_to_salt> <secret_key_file>"
    )
    parser.add_argument("string_to_salt")
    parser.add_argument("secret_key_file")

    args = parser.parse_args()
    return args

def main():
    args = parse_args()

    try:
        with open(str(secret_key_file), 'rb') as f:
            sk = f.read().strip()
    except IOError:
        print 'Bad file name for secret key.'
        return

    print salt_string(str(args.string_to_salt), sk)

if __name__  == '__main__':
    sys.exit(main())
rfaulkner commented 11 years ago

implemented. https://github.com/rfaulkner/E3_analysis/commit/e87eddb7bd855aaab53d01037791802a06246417

used werkzeug.security built in methods.