Adds random salt to user passwords (#7410).

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@4936 e93f8b46-1217-0410-a6f0-8f06a7374b81

2 files changed, 46 insertions, 6 deletions

diff --git a/test/fixtures/users.yml b/test/fixtures/users.yml
index f26c09c0b..1e612fc90 100644
--- a/test/fixtures/users.yml
+++ b/test/fixtures/users.yml
@@ -4,7 +4,9 @@ users_004:
   status: 1
   last_login_on: 
   language: en
-  hashed_password: 4e4aeb7baaf0706bd670263fef42dad15763b608
+  # password = foo
+  salt: 3126f764c3c5ac61cbfc103f25f934cf
+  hashed_password: 9e4dd7eeb172c12a0691a6d9d3a269f7e9fe671b
   updated_on: 2006-07-19 19:34:07 +02:00
   admin: false
   mail: rhill@somenet.foo
@@ -20,7 +22,9 @@ users_001:
   status: 1
   last_login_on: 2006-07-19 22:57:52 +02:00
   language: en
-  hashed_password: d033e22ae348aeb5660fc2140aec35850c4da997
+  # password = admin
+  salt: 82090c953c4a0000a7db253b0691a6b4
+  hashed_password: b5b6ff9543bf1387374cdfa27a54c96d236a7150
   updated_on: 2006-07-19 22:57:52 +02:00
   admin: true
   mail: admin@somenet.foo
@@ -36,7 +40,9 @@ users_002:
   status: 1
   last_login_on: 2006-07-19 22:42:15 +02:00
   language: en
-  hashed_password: a9a653d4151fa2c081ba1ffc2c2726f3b80b7d7d
+  # password = jsmith
+  salt: 67eb4732624d5a7753dcea7ce0bb7d7d
+  hashed_password: bfbe06043353a677d0215b26a5800d128d5413bc
   updated_on: 2006-07-19 22:42:15 +02:00
   admin: false
   mail: jsmith@somenet.foo
@@ -52,7 +58,9 @@ users_003:
   status: 1
   last_login_on: 
   language: en
-  hashed_password: 7feb7657aa7a7bf5aef3414a5084875f27192415
+  # password = foo
+  salt: 7599f9963ec07b5a3b55b354407120c0
+  hashed_password: 8f659c8d7c072f189374edacfa90d6abbc26d8ed
   updated_on: 2006-07-19 19:33:19 +02:00
   admin: false
   mail: dlopper@somenet.foo
@@ -70,7 +78,7 @@ users_005:
   status: 3
   last_login_on: 
   language: en
-  hashed_password: 7feb7657aa7a7bf5aef3414a5084875f27192415
+  hashed_password: 1
   updated_on: 2006-07-19 19:33:19 +02:00
   admin: false
   mail: dlopper2@somenet.foo
diff --git a/test/unit/user_test.rb b/test/unit/user_test.rb
index 63e422701..3f324ddc4 100644
--- a/test/unit/user_test.rb
+++ b/test/unit/user_test.rb
@@ -361,7 +361,6 @@ class UserTest < ActiveSupport::TestCase
     user = User.try_to_login("admin", "hello")
     assert_kind_of User, user
     assert_equal "admin", user.login
-    assert_equal User.hash_password("hello"), user.hashed_password    
   end
   
   def test_name_format
@@ -383,6 +382,22 @@ class UserTest < ActiveSupport::TestCase
     assert_equal nil, user  
   end
   
+  context ".try_to_login" do
+    context "with good credentials" do
+      should "return the user" do
+        user = User.try_to_login("admin", "admin")
+        assert_kind_of User, user
+        assert_equal "admin", user.login
+      end
+    end
+    
+    context "with wrong credentials" do
+      should "return nil" do
+        assert_nil User.try_to_login("admin", "foo")
+      end
+    end
+  end
+  
   if ldap_configured?
     context "#try_to_login using LDAP" do
       context "with failed connection to the LDAP server" do
@@ -727,6 +742,23 @@ class UserTest < ActiveSupport::TestCase
       should 'be added and tested'
     end
   end
+
+  def test_salt_unsalted_passwords
+    # Restore a user with an unsalted password
+    user = User.find(1)
+    user.salt = nil
+    user.hashed_password = User.hash_password("unsalted")
+    user.save!
+    
+    User.salt_unsalted_passwords!
+    
+    user.reload
+    # Salt added
+    assert !user.salt.blank?
+    # Password still valid
+    assert user.check_password?("unsalted")
+    assert_equal user, User.try_to_login(user.login, "unsalted")
+  end
   
   if Object.const_defined?(:OpenID)