mbk-lab
/
nextcloud
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Increase device password entropy. Use lower- and upper-case characters and digits, but exclude ambiguous characters. The number of digits has also been increased to 25. 

Signed-off-by: Fabrizio Steiner <fabrizio.steiner@gmail.com>
This commit is contained in:
Fabrizio Steiner 2017-05-07 23:10:02 +02:00
parent 59ee22101f
commit f2a2b34e46
4 changed files with 15 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
lib/public/Security/ISecureRandom.php
View File

@ -44,6 +44,13 @@ interface ISecureRandom {
const CHAR_DIGITS = '0123456789';
const CHAR_SYMBOLS = '!\"#$%&\\\'()* +,-./:;<=>?@[\]^_`{|}~';
/**
* Characters that can be used for <code>generate($length, $characters)</code>, to
* generate human readable random strings. Lower- and upper-case characters and digits
* are included. Characters which are ambiguous are excluded, such as I, l, and 1 and so on.
*/
const CHAR_HUMAN_READABLE = "abcdefgijkmnopqrstwxyzABCDEFGHJKLMNPQRSTWXYZ23456789";
/**
* Convenience method to get a low strength random number generator.
*

8
settings/Controller/AuthSettingsController.php
View File

@ -154,16 +154,16 @@ class AuthSettingsController extends Controller {
}
/**
* Return a 20 digit device password
* Return a 25 digit device password
*
* Example: ABCDE-FGHIJ-KLMNO-PQRST
* Example: AbCdE-fGhIj-KlMnO-pQrSt-12345
*
* @return string
*/
private function generateRandomDeviceToken() {
$groups = [];
for ($i = 0; $i < 4; $i++) {
$groups[] = $this->random->generate(5, implode('', range('A', 'Z')));
for ($i = 0; $i < 5; $i++) {
$groups[] = $this->random->generate(5, ISecureRandom::CHAR_HUMAN_READABLE);
}
return implode('-', $groups);
}

2
settings/css/settings.css
View File

@ -343,7 +343,7 @@ table.nostyle td { padding: 0.2em 0; }
#new-app-login-name,
#new-app-password {
width: 186px;
width: 245px;
font-family: monospace;
background-color: lightyellow;
}

6
tests/Settings/Controller/AuthSettingsControllerTest.php
View File

@ -133,11 +133,11 @@ class AuthSettingsControllerTest extends TestCase {
->method('getLoginName')
->will($this->returnValue('User13'));
$this->secureRandom->expects($this->exactly(4))
$this->secureRandom->expects($this->exactly(5))
->method('generate')
->with(5, implode('', range('A', 'Z')))
->with(5, ISecureRandom::CHAR_HUMAN_READABLE)
->will($this->returnValue('XXXXX'));
$newToken = 'XXXXX-XXXXX-XXXXX-XXXXX';
$newToken = 'XXXXX-XXXXX-XXXXX-XXXXX-XXXXX';
$this->tokenProvider->expects($this->once())
->method('generateToken')