diff options
| author | Lunny Xiao <xiaolunwen@gmail.com> | 2021-02-14 04:19:33 +0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-02-13 21:19:33 +0100 |
| commit | c0320065b67439f1c87130a3fcd2f821fc7722bd (patch) | |
| tree | d4ef2cbdde54ab7642edc1817045d4f6315f809f | |
| parent | a1b74c55092b846f08a3432b313abcc4994b7259 (diff) | |
| download | gitea-c0320065b67439f1c87130a3fcd2f821fc7722bd.tar.gz gitea-c0320065b67439f1c87130a3fcd2f821fc7722bd.zip | |
Turn default hash password algorightm back to pbkdf2 from argon2 until we found a better one (#14673) (#14675)
* Turn default hash password algorightm back to pbkdf2 from argon2 until we found a better one
* Add a warning on document
Co-authored-by: zeripath <art27@cantab.net>
| -rw-r--r-- | custom/conf/app.example.ini | 2 | ||||
| -rw-r--r-- | docs/content/doc/advanced/config-cheat-sheet.en-us.md | 2 | ||||
| -rw-r--r-- | modules/setting/setting.go | 2 |
3 files changed, 3 insertions, 3 deletions
diff --git a/custom/conf/app.example.ini b/custom/conf/app.example.ini index f060f13c58..a3349f9865 100644 --- a/custom/conf/app.example.ini +++ b/custom/conf/app.example.ini @@ -548,7 +548,7 @@ ONLY_ALLOW_PUSH_IF_GITEA_ENVIRONMENT_SET = true ;Classes include "lower,upper,digit,spec" PASSWORD_COMPLEXITY = off ; Password Hash algorithm, either "argon2", "pbkdf2", "scrypt" or "bcrypt" -PASSWORD_HASH_ALGO = argon2 +PASSWORD_HASH_ALGO = pbkdf2 ; Set false to allow JavaScript to read CSRF cookie CSRF_COOKIE_HTTP_ONLY = true ; Validate against https://haveibeenpwned.com/Passwords to see if a password has been exposed diff --git a/docs/content/doc/advanced/config-cheat-sheet.en-us.md b/docs/content/doc/advanced/config-cheat-sheet.en-us.md index ca09d4f032..77464a509a 100644 --- a/docs/content/doc/advanced/config-cheat-sheet.en-us.md +++ b/docs/content/doc/advanced/config-cheat-sheet.en-us.md @@ -402,7 +402,7 @@ relation to port exhaustion. - `IMPORT_LOCAL_PATHS`: **false**: Set to `false` to prevent all users (including admin) from importing local path on server. - `INTERNAL_TOKEN`: **\<random at every install if no uri set\>**: Secret used to validate communication within Gitea binary. - `INTERNAL_TOKEN_URI`: **<empty>**: Instead of defining internal token in the configuration, this configuration option can be used to give Gitea a path to a file that contains the internal token (example value: `file:/etc/gitea/internal_token`) -- `PASSWORD_HASH_ALGO`: **argon2**: The hash algorithm to use \[argon2, pbkdf2, scrypt, bcrypt\]. +- `PASSWORD_HASH_ALGO`: **pbkdf2**: The hash algorithm to use \[argon2, pbkdf2, scrypt, bcrypt\], argon2 will spend more memory than others. - `CSRF_COOKIE_HTTP_ONLY`: **true**: Set false to allow JavaScript to read CSRF cookie. - `MIN_PASSWORD_LENGTH`: **6**: Minimum password length for new users. - `PASSWORD_COMPLEXITY`: **off**: Comma separated list of character classes required to pass minimum complexity. If left empty or no valid values are specified, checking is disabled (off): diff --git a/modules/setting/setting.go b/modules/setting/setting.go index 7ae8bb352d..77a18e3593 100644 --- a/modules/setting/setting.go +++ b/modules/setting/setting.go @@ -771,7 +771,7 @@ func NewContext() { ImportLocalPaths = sec.Key("IMPORT_LOCAL_PATHS").MustBool(false) DisableGitHooks = sec.Key("DISABLE_GIT_HOOKS").MustBool(true) OnlyAllowPushIfGiteaEnvironmentSet = sec.Key("ONLY_ALLOW_PUSH_IF_GITEA_ENVIRONMENT_SET").MustBool(true) - PasswordHashAlgo = sec.Key("PASSWORD_HASH_ALGO").MustString("argon2") + PasswordHashAlgo = sec.Key("PASSWORD_HASH_ALGO").MustString("pbkdf2") CSRFCookieHTTPOnly = sec.Key("CSRF_COOKIE_HTTP_ONLY").MustBool(true) PasswordCheckPwn = sec.Key("PASSWORD_CHECK_PWN").MustBool(false) |