On 10/28/06, Andrew Grover <[EMAIL PROTECTED]> wrote:
In many situations not. Actually, the code attached saves the password encrypted using the provider's encryption algorithm, which is better (but the default is plain-text).
Unfortunately, validate_password() wants the password in plain-text, so I had to monkey-patch the providers again to accept either encrypted password or plain-text password:
def validate_password(self, user, user_name, password):
return user.password in (password, self.encrypt_password(password))
and in IdentityVisitPlugin.__init__, I've added:
self.provider.__class__.validate_password = validate_password
(the full version is attached).
The only thing I see that might turn into a security problem, is that if someone got the encrypted password by hacking to the SQL server. Then he'll be able to login without knowing the real password. But any other autologin solution I know is vulnerable when the SQL server is hacked.
Can anyone advice if this is a security risk to accept both encrypted password and the plain-text one?
On 10/27/06, Nadav Samet <[EMAIL PROTECTED]> wrote:
> You can always send the username/password as a cookie (tg_remember_me), and
> use it as a way of authentication. This will not require any new table.
Is saving username and password in a cookie an OK thing to do?
In many situations not. Actually, the code attached saves the password encrypted using the provider's encryption algorithm, which is better (but the default is plain-text).
Unfortunately, validate_password() wants the password in plain-text, so I had to monkey-patch the providers again to accept either encrypted password or plain-text password:
def validate_password(self, user, user_name, password):
return user.password in (password, self.encrypt_password(password))
and in IdentityVisitPlugin.__init__, I've added:
self.provider.__class__.validate_password = validate_password
(the full version is attached).
The only thing I see that might turn into a security problem, is that if someone got the encrypted password by hacking to the SQL server. Then he'll be able to login without knowing the real password. But any other autologin solution I know is vulnerable when the SQL server is hacked.
--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups "TurboGears Trunk" group.
To post to this group, send email to [email protected]
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/turbogears-trunk
-~----------~----~----~----~------~----~------~--~---
