diff options
| author | John Olheiser <john.olheiser@gmail.com> | 2020-09-08 17:06:39 -0500 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2020-09-08 17:06:39 -0500 |
| commit | c6e4bc53aad371210f0cb670e36c57132087b230 (patch) | |
| tree | ef2eecef855a4257a22eb61aefd5439be23a770e /routers/api/v1/admin/user.go | |
| parent | bea343ce0997262e61c5d83812a270090896afbf (diff) | |
| download | gitea-c6e4bc53aad371210f0cb670e36c57132087b230.tar.gz gitea-c6e4bc53aad371210f0cb670e36c57132087b230.zip | |
Check passwords against HaveIBeenPwned (#12716)
* Implement pwn
Signed-off-by: jolheiser <john.olheiser@gmail.com>
* Update module
Signed-off-by: jolheiser <john.olheiser@gmail.com>
* Apply suggestions mrsdizzie
Co-authored-by: mrsdizzie <info@mrsdizzie.com>
* Add link to HIBP
Signed-off-by: jolheiser <john.olheiser@gmail.com>
* Add more details to admin command
Signed-off-by: jolheiser <john.olheiser@gmail.com>
* Add context to pwn
Signed-off-by: jolheiser <john.olheiser@gmail.com>
* Consistency and making some noise ;)
Signed-off-by: jolheiser <john.olheiser@gmail.com>
Co-authored-by: mrsdizzie <info@mrsdizzie.com>
Co-authored-by: zeripath <art27@cantab.net>
Diffstat (limited to 'routers/api/v1/admin/user.go')
| -rw-r--r-- | routers/api/v1/admin/user.go | 19 |
1 files changed, 18 insertions, 1 deletions
diff --git a/routers/api/v1/admin/user.go b/routers/api/v1/admin/user.go index a8a573eaf0..dc095f3a13 100644 --- a/routers/api/v1/admin/user.go +++ b/routers/api/v1/admin/user.go @@ -87,6 +87,15 @@ func CreateUser(ctx *context.APIContext, form api.CreateUserOption) { ctx.Error(http.StatusBadRequest, "PasswordComplexity", err) return } + pwned, err := password.IsPwned(ctx.Req.Context(), form.Password) + if pwned { + if err != nil { + log.Error(err.Error()) + } + ctx.Data["Err_Password"] = true + ctx.Error(http.StatusBadRequest, "PasswordPwned", errors.New("PasswordPwned")) + return + } if err := models.CreateUser(u); err != nil { if models.IsErrUserAlreadyExist(err) || models.IsErrEmailAlreadyUsed(err) || @@ -151,7 +160,15 @@ func EditUser(ctx *context.APIContext, form api.EditUserOption) { ctx.Error(http.StatusBadRequest, "PasswordComplexity", err) return } - var err error + pwned, err := password.IsPwned(ctx.Req.Context(), form.Password) + if pwned { + if err != nil { + log.Error(err.Error()) + } + ctx.Data["Err_Password"] = true + ctx.Error(http.StatusBadRequest, "PasswordPwned", errors.New("PasswordPwned")) + return + } if u.Salt, err = models.GetUserSalt(); err != nil { ctx.Error(http.StatusInternalServerError, "UpdateUser", err) return |