56 commits

Author	SHA1	Message	Date
Gusted	623c93ff46	Increase Salt randomness (#18179) ... - The current implementation of `RandomString` doesn't give you a most-possible unique randomness. It gives you 6*`length` instead of the possible 8*`length` bits(or as `length`x bytes) randomness. This is because `RandomString` is being limited to a max value of 63, this in order to represent the random byte as a letter/digit. - The recommendation of pbkdf2 is to use 64+ bit salt, which the `RandomString` doesn't give with a length of 10, instead of increasing 10 to a higher number, this patch adds a new function called `RandomBytes` which does give you the guarentee of 8*`length` randomness and thus corresponding of `length`x bytes randomness. - Use hexadecimal to store the bytes value in the database, as mentioned, it doesn't play nice in order to convert it to a string. This will always be a length of 32(with `length` being 16). - When we detect on `Authenticate`(source: db) that a user has the old format of salt, re-hash the password such that the user will have it's password hashed with increased salt. Thanks to @zeripath for working out the rouge edges from my first commit 😄. Co-authored-by: lafriks <lauris@nix.lv> Co-authored-by: zeripath <art27@cantab.net>	2022-01-04 15:13:52 +00:00
Lunny Xiao	de8e3948a5	Refactor auth package (#17962)	2022-01-02 21:12:35 +08:00
zeripath	8354670708	Prevent hang in git cat-file if repository is not a valid repository and other fixes (#17991) ... This PR contains multiple fixes. The most important of which is: * Prevent hang in git cat-file if the repository is not a valid repository Unfortunately it appears that if git cat-file is run in an invalid repository it will hang until stdin is closed. This will result in deadlocked /pulls pages and dangling git cat-file calls if a broken repository is tried to be reviewed or pulls exists for a broken repository. Fix #14734 Fix #9271 Fix #16113 Otherwise there are a few small other fixes included which this PR was initially intending to fix: * Fix panic on partial compares due to missing PullRequestWorkInProgressPrefixes * Fix links on pulls pages due to regression from #17551 - by making most /issues routes match /pulls too - Fix #17983 * Fix links on feeds pages due to another regression from #17551 but also fix issue with syncing tags - Fix #17943 * Add missing locale entries for oauth group claims * Prevent NPEs if ColorFormat is called on nil users, repos or teams.	2021-12-16 19:01:14 +00:00
a1012112796	ba57e30f13	fix 500 error while use a reserved name in org rename (#17878) ... fix #17876 Signed-off-by: a1012112796 <1012112796@qq.com>	2021-12-02 10:43:43 +08:00
Lunny Xiao	371ebce252	Fix database inconsistent when admin change user email (#17549)	2021-11-25 20:56:16 -05:00
Lunny Xiao	a666829a37	Move user related model into models/user (#17781) ... * Move user related model into models/user * Fix lint for windows * Fix windows lint * Fix windows lint * Move some tests in models * Merge	2021-11-24 17:49:20 +08:00