Commit 3e63f59c authored by Phyks's avatar Phyks Committed by Luc Didry

Hash password in config file using SHA256

parent 17f22e49
......@@ -6,7 +6,7 @@ test:
- echo yes | cpan Carton
- carton install
- cp lstu.conf.template lstu.conf
- sed -i -e "s@#contact@contact@" -e "s@#adminpwd.*@adminpwd => 'toto',@" -e "s@#db_path.*@db_path => 'test.db',@" lstu.conf
- sed -i -e "s@#contact@contact@" -e "s@#adminpwd.*@adminpwd => '31f7a65e315586ac198bd798b6629ce4903d0899476d5741a9f32e2e521b6a66',@" -e "s@#db_path.*@db_path => 'test.db',@" lstu.conf
- rm -f test.db
- make test
tags:
......
# vim:set sw=4 ts=4 sts=4 ft=perl expandtab:
package Lstu::Controller::Admin;
use Digest::SHA qw(sha256_hex);
use Mojo::Base 'Mojolicious::Controller';
use LstuModel;
......@@ -26,7 +27,7 @@ sub login {
$c->flash('banned' => 1);
$c->redirect_to('stats');
} else {
if (defined($c->config('adminpwd')) && defined($pwd) && $pwd eq $c->config('adminpwd')) {
if (defined($c->config('adminpwd')) && defined($pwd) && sha256_hex($pwd) eq $c->config('adminpwd')) {
my $token = $c->shortener(32);
LstuModel::Sessions->create(
......
......@@ -21,8 +21,9 @@
#secret => ['fdjsofjoihrei'],
# secret passphrase to access some admin features
# The passphrase should be encoded in SHA256 (hex)
# optional, but you won't have access to admin /stats if not set
#adminpwd => 's3cr3T',
#adminpwd => '4e738ca5563c06cfd0018299933d58db1dd8bf97f6973dc99bf6cdc64b5550bd',
# choose a theme. See the available themes in `themes` directory
# optional, default is 'default'
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment