owen/lms
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Split auth service in two services

Browse Source
This commit is contained in:
emeric
2019-07-30 13:17:25 +02:00
parent d114c763c3
commit 40000249c6
12 changed files with 363 additions and 235 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/Makefile.am
+4 -2
View File
@@ -7,8 +7,10 @@ lms_SOURCES = \
$(srcdir)/api/subsonic/SubsonicResource.hpp \
$(srcdir)/api/subsonic/SubsonicResponse.cpp \
$(srcdir)/api/subsonic/SubsonicResponse.hpp \
$(srcdir)/auth/AuthService.cpp \
$(srcdir)/auth/AuthService.hpp \
$(srcdir)/auth/AuthTokenService.cpp \
$(srcdir)/auth/AuthTokenService.hpp \
$(srcdir)/auth/PasswordService.cpp \
$(srcdir)/auth/PasswordService.hpp \
$(srcdir)/auth/LoginThrottler.cpp \
$(srcdir)/auth/LoginThrottler.hpp \
$(srcdir)/av/AvInfo.cpp \
src/api/subsonic/SubsonicResource.cpp
+5 -5
View File
@@ -26,7 +26,7 @@
#include <Wt/WLocalDateTime.h>
#include "auth/AuthService.hpp"
#include "auth/PasswordService.hpp"
#include "av/AvTranscoder.hpp"
#include "cover/CoverArtGrabber.hpp"
#include "database/Artist.hpp"
@@ -406,15 +406,15 @@ SubsonicResource::handleRequest(const Wt::Http::Request &request, Wt::Http::Resp
const ClientInfo clientInfo {getClientInfo(parameters)};
switch (getService<Auth::AuthService>()->checkUserPassword(dbSession,
switch (getService<Auth::PasswordService>()->checkUserPassword(dbSession,
boost::asio::ip::address::from_string(request.clientAddress()),
clientInfo.user, clientInfo.password))
{
case Auth::AuthService::PasswordCheckResult::Match:
case Auth::PasswordService::PasswordCheckResult::Match:
break;
case Auth::AuthService::PasswordCheckResult::Mismatch:
case Auth::PasswordService::PasswordCheckResult::Mismatch:
throw Error {Error::Code::WrongUsernameOrPassword};
case Auth::AuthService::PasswordCheckResult::Throttled:
case Auth::PasswordService::PasswordCheckResult::Throttled:
throw Error {Error::CustomType::LoginThrottled};
}
src/auth/AuthService.cpp
-194
View File
@@ -1,194 +0,0 @@
/*
* Copyright (C) 2019 Emeric Poupon
*
* This file is part of LMS.
*
* LMS is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* LMS is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with LMS. If not, see <http://www.gnu.org/licenses/>.
*/
/* This file contains some classes in order to get info from file using the libavconv */
#include "AuthService.hpp"
#include <Wt/Auth/HashFunction.h>
#include <Wt/Auth/PasswordStrengthValidator.h>
#include <Wt/WRandom.h>
#include "database/Session.hpp"
#include "utils/Exception.hpp"
#include "utils/Utils.hpp"
#include "utils/Logger.hpp"
namespace Auth {
AuthService::AuthService(std::size_t maxThrottlerEntries)
: _passwordLoginThrottler {maxThrottlerEntries}
, _tokenLoginThrottler {maxThrottlerEntries}
{
}
static
bool
checkUserPassword(Database::Session& session, const std::string& loginName, const std::string& password)
{
Database::User::PasswordHash passwordHash;
{
auto transaction {session.createSharedTransaction()};
const Database::User::pointer user {Database::User::getByLoginName(session, loginName)};
if (!user)
return false;
passwordHash = user->getPasswordHash();
}
const Wt::Auth::BCryptHashFunction hashFunc {6};
return hashFunc.verify(password, passwordHash.salt, passwordHash.hash);
}
AuthService::PasswordCheckResult
AuthService::checkUserPassword(Database::Session& session, const boost::asio::ip::address& clientAddress, const std::string& loginName, const std::string& password)
{
// Do not waste too much resource on brute force attacks (optim)
{
std::shared_lock<std::shared_timed_mutex> lock {_passwordCheckMutex};
if (_passwordLoginThrottler.isClientThrottled(clientAddress))
return PasswordCheckResult::Throttled;
}
const bool match {Auth::checkUserPassword(session, loginName, password)};
{
std::unique_lock<std::shared_timed_mutex> lock {_passwordCheckMutex};
if (_passwordLoginThrottler.isClientThrottled(clientAddress))
return PasswordCheckResult::Throttled;
if (match)
{
_passwordLoginThrottler.onGoodClientAttempt(clientAddress);
return PasswordCheckResult::Match;
}
else
{
_passwordLoginThrottler.onBadClientAttempt(clientAddress);
return PasswordCheckResult::Mismatch;
}
}
}
Database::User::PasswordHash
AuthService::hashPassword(const std::string& password) const
{
const std::string salt {Wt::WRandom::generateId(32)};
const Wt::Auth::BCryptHashFunction hashFunc {6};
return {salt, hashFunc.compute(password, salt)};
}
bool
AuthService::evaluatePasswordStrength(const std::string& loginName, const std::string& password) const
{
Wt::Auth::PasswordStrengthValidator validator;
validator.setMinimumLength(Wt::Auth::PasswordStrengthType::OneCharClass, 4);
validator.setMinimumLength(Wt::Auth::PasswordStrengthType::TwoCharClass, 4);
validator.setMinimumLength(Wt::Auth::PasswordStrengthType::PassPhrase, 4);
validator.setMinimumLength(Wt::Auth::PasswordStrengthType::ThreeCharClass, 4);
validator.setMinimumLength(Wt::Auth::PasswordStrengthType::FourCharClass, 4);
validator.setMinimumPassPhraseWords(1);
validator.setMinimumMatchLength(3);
return validator.evaluateStrength(password, loginName, "").isValid();
}
std::string
AuthService::createAuthToken(Database::Session& session, Database::IdType userId, const Wt::WDateTime& expiry)
{
const std::string secret {Wt::WRandom::generateId(64)};
auto transaction {session.createUniqueTransaction()};
Database::User::pointer user {Database::User::getById(session, userId)};
if (!user)
throw LmsException {"User deleted"};
Database::AuthToken::pointer authToken {Database::AuthToken::create(session, secret, expiry, user)};
LMS_LOG(UI, DEBUG) << "Created auth token for user '" << user->getLoginName() << "', expiry = " << expiry.toString();
if (user->getAuthTokensCount() >= 50)
Database::AuthToken::removeExpiredTokens(session, Wt::WDateTime::currentDateTime());
return secret;
}
static
boost::optional<AuthService::AuthTokenProcessResult::AuthTokenInfo>
processAuthToken(Database::Session& session, const std::string& tokenValue)
{
auto transaction {session.createUniqueTransaction()};
Database::AuthToken::pointer authToken {Database::AuthToken::getByValue(session, tokenValue)};
if (!authToken)
return boost::none;
if (authToken->getExpiry() < Wt::WDateTime::currentDateTime())
{
authToken.remove();
return boost::none;
}
LMS_LOG(UI, DEBUG) << "Found auth token for user '" << authToken->getUser()->getLoginName() << "'!";
AuthService::AuthTokenProcessResult::AuthTokenInfo res {authToken->getUser().id(), authToken->getExpiry()};
authToken.remove();
return res;
}
AuthService::AuthTokenProcessResult
AuthService::processAuthToken(Database::Session& session, const boost::asio::ip::address& clientAddress, const std::string& tokenValue)
{
// Do not waste too much resource on brute force attacks (optim)
{
std::shared_lock<std::shared_timed_mutex> lock {_tokenCheckMutex};
if (_tokenLoginThrottler.isClientThrottled(clientAddress))
return AuthTokenProcessResult {AuthTokenProcessResult::State::Throttled};
}
auto res {Auth::processAuthToken(session, tokenValue)};
{
std::unique_lock<std::shared_timed_mutex> lock {_tokenCheckMutex};
if (_tokenLoginThrottler.isClientThrottled(clientAddress))
return AuthTokenProcessResult {AuthTokenProcessResult::State::Throttled};
if (!res)
{
_tokenLoginThrottler.onBadClientAttempt(clientAddress);
return AuthTokenProcessResult {AuthTokenProcessResult::State::NotFound};
}
_tokenLoginThrottler.onGoodClientAttempt(clientAddress);
return AuthTokenProcessResult {AuthTokenProcessResult::State::Found, std::move(*res)};
}
}
} // namespace Auth
src/auth/AuthTokenService.cpp
+117
View File
@@ -0,0 +1,117 @@
/*
* Copyright (C) 2019 Emeric Poupon
*
* This file is part of LMS.
*
* LMS is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* LMS is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with LMS. If not, see <http://www.gnu.org/licenses/>.
*/
/* This file contains some classes in order to get info from file using the libavconv */
#include "AuthTokenService.hpp"
#include <Wt/Auth/HashFunction.h>
#include <Wt/Auth/PasswordStrengthValidator.h>
#include <Wt/WRandom.h>
#include "database/Session.hpp"
#include "utils/Exception.hpp"
#include "utils/Utils.hpp"
#include "utils/Logger.hpp"
namespace Auth {
AuthTokenService::AuthTokenService(std::size_t maxThrottlerEntries)
: _loginThrottler {maxThrottlerEntries}
{
}
std::string
AuthTokenService::createAuthToken(Database::Session& session, Database::IdType userId, const Wt::WDateTime& expiry)
{
const std::string secret {Wt::WRandom::generateId(64)};
auto transaction {session.createUniqueTransaction()};
Database::User::pointer user {Database::User::getById(session, userId)};
if (!user)
throw LmsException {"User deleted"};
Database::AuthToken::pointer authToken {Database::AuthToken::create(session, secret, expiry, user)};
LMS_LOG(UI, DEBUG) << "Created auth token for user '" << user->getLoginName() << "', expiry = " << expiry.toString();
if (user->getAuthTokensCount() >= 50)
Database::AuthToken::removeExpiredTokens(session, Wt::WDateTime::currentDateTime());
return secret;
}
static
boost::optional<AuthTokenService::AuthTokenProcessResult::AuthTokenInfo>
processAuthToken(Database::Session& session, const std::string& tokenValue)
{
auto transaction {session.createUniqueTransaction()};
Database::AuthToken::pointer authToken {Database::AuthToken::getByValue(session, tokenValue)};
if (!authToken)
return boost::none;
if (authToken->getExpiry() < Wt::WDateTime::currentDateTime())
{
authToken.remove();
return boost::none;
}
LMS_LOG(UI, DEBUG) << "Found auth token for user '" << authToken->getUser()->getLoginName() << "'!";
AuthTokenService::AuthTokenProcessResult::AuthTokenInfo res {authToken->getUser().id(), authToken->getExpiry()};
authToken.remove();
return res;
}
AuthTokenService::AuthTokenProcessResult
AuthTokenService::processAuthToken(Database::Session& session, const boost::asio::ip::address& clientAddress, const std::string& tokenValue)
{
// Do not waste too much resource on brute force attacks (optim)
{
std::shared_lock<std::shared_timed_mutex> lock {_mutex};
if (_loginThrottler.isClientThrottled(clientAddress))
return AuthTokenProcessResult {AuthTokenProcessResult::State::Throttled};
}
auto res {Auth::processAuthToken(session, tokenValue)};
{
std::unique_lock<std::shared_timed_mutex> lock {_mutex};
if (_loginThrottler.isClientThrottled(clientAddress))
return AuthTokenProcessResult {AuthTokenProcessResult::State::Throttled};
if (!res)
{
_loginThrottler.onBadClientAttempt(clientAddress);
return AuthTokenProcessResult {AuthTokenProcessResult::State::NotFound};
}
_loginThrottler.onGoodClientAttempt(clientAddress);
return AuthTokenProcessResult {AuthTokenProcessResult::State::Found, std::move(*res)};
}
}
} // namespace Auth
src/auth/AuthTokenService.hpp
+87
View File
@@ -0,0 +1,87 @@
/*
* Copyright (C) 2019 Emeric Poupon
*
* This file is part of LMS.
*
* LMS is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* LMS is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with LMS. If not, see <http://www.gnu.org/licenses/>.
*/
/* This file contains some classes in order to get info from file using the libavconv */
#pragma once
#include <string>
#include <boost/optional.hpp>
#include <boost/asio/ip/address.hpp>
#include "LoginThrottler.hpp"
#include "database/User.hpp"
#include "database/Types.hpp"
namespace Database
{
class Session;
}
namespace Auth {
class AuthTokenService
{
public:
AuthTokenService(std::size_t maxThrottlerEntries);
AuthTokenService() = default;
~AuthTokenService() = default;
AuthTokenService(const AuthTokenService&) = delete;
AuthTokenService& operator=(const AuthTokenService&) = delete;
AuthTokenService(AuthTokenService&&) = delete;
AuthTokenService& operator=(AuthTokenService&&) = delete;
// Auth Token services
struct AuthTokenProcessResult
{
enum class State
{
Found,
Throttled,
NotFound,
};
struct AuthTokenInfo
{
Database::IdType userId;
Wt::WDateTime expiry;
};
State state;
boost::optional<AuthTokenInfo> authTokenInfo;
};
// Removed if found
AuthTokenProcessResult processAuthToken(Database::Session& session, const boost::asio::ip::address& clientAddress, const std::string& tokenValue);
std::string createAuthToken(Database::Session& session, Database::IdType userid, const Wt::WDateTime& expiry);
private:
std::shared_timed_mutex _mutex;
LoginThrottler _loginThrottler;
};
}
src/auth/PasswordService.cpp
+116
View File
@@ -0,0 +1,116 @@
/*
* Copyright (C) 2019 Emeric Poupon
*
* This file is part of LMS.
*
* LMS is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* LMS is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with LMS. If not, see <http://www.gnu.org/licenses/>.
*/
/* This file contains some classes in order to get info from file using the libavconv */
#include "PasswordService.hpp"
#include <Wt/Auth/HashFunction.h>
#include <Wt/Auth/PasswordStrengthValidator.h>
#include <Wt/WRandom.h>
#include "database/Session.hpp"
#include "utils/Exception.hpp"
#include "utils/Utils.hpp"
#include "utils/Logger.hpp"
namespace Auth {
PasswordService::PasswordService(std::size_t maxThrottlerEntries)
: _loginThrottler{maxThrottlerEntries}
{
}
static
bool
checkUserPassword(Database::Session& session, const std::string& loginName, const std::string& password)
{
Database::User::PasswordHash passwordHash;
{
auto transaction {session.createSharedTransaction()};
const Database::User::pointer user {Database::User::getByLoginName(session, loginName)};
if (!user)
return false;
passwordHash = user->getPasswordHash();
}
const Wt::Auth::BCryptHashFunction hashFunc {6};
return hashFunc.verify(password, passwordHash.salt, passwordHash.hash);
}
PasswordService::PasswordCheckResult
PasswordService::checkUserPassword(Database::Session& session, const boost::asio::ip::address& clientAddress, const std::string& loginName, const std::string& password)
{
// Do not waste too much resource on brute force attacks (optim)
{
std::shared_lock<std::shared_timed_mutex> lock {_mutex};
if (_loginThrottler.isClientThrottled(clientAddress))
return PasswordCheckResult::Throttled;
}
const bool match {Auth::checkUserPassword(session, loginName, password)};
{
std::unique_lock<std::shared_timed_mutex> lock {_mutex};
if (_loginThrottler.isClientThrottled(clientAddress))
return PasswordCheckResult::Throttled;
if (match)
{
_loginThrottler.onGoodClientAttempt(clientAddress);
return PasswordCheckResult::Match;
}
else
{
_loginThrottler.onBadClientAttempt(clientAddress);
return PasswordCheckResult::Mismatch;
}
}
}
Database::User::PasswordHash
PasswordService::hashPassword(const std::string& password) const
{
const std::string salt {Wt::WRandom::generateId(32)};
const Wt::Auth::BCryptHashFunction hashFunc {6};
return {salt, hashFunc.compute(password, salt)};
}
bool
PasswordService::evaluatePasswordStrength(const std::string& loginName, const std::string& password) const
{
Wt::Auth::PasswordStrengthValidator validator;
validator.setMinimumLength(Wt::Auth::PasswordStrengthType::OneCharClass, 4);
validator.setMinimumLength(Wt::Auth::PasswordStrengthType::TwoCharClass, 4);
validator.setMinimumLength(Wt::Auth::PasswordStrengthType::PassPhrase, 4);
validator.setMinimumLength(Wt::Auth::PasswordStrengthType::ThreeCharClass, 4);
validator.setMinimumLength(Wt::Auth::PasswordStrengthType::FourCharClass, 4);
validator.setMinimumPassPhraseWords(1);
validator.setMinimumMatchLength(3);
return validator.evaluateStrength(password, loginName, "").isValid();
}
} // namespace Auth
src/auth/AuthService.hpp → src/auth/PasswordService.hpp
+10 -13
View File
@@ -38,19 +38,19 @@ namespace Database
namespace Auth {
class AuthService
class PasswordService
{
public:
AuthService(std::size_t maxThrottlerEntries);
PasswordService(std::size_t maxThrottlerEntries);
AuthService() = default;
~AuthService() = default;
PasswordService() = default;
~PasswordService() = default;
AuthService(const AuthService&) = delete;
AuthService& operator=(const AuthService&) = delete;
AuthService(AuthService&&) = delete;
AuthService& operator=(AuthService&&) = delete;
PasswordService(const PasswordService&) = delete;
PasswordService& operator=(const PasswordService&) = delete;
PasswordService(PasswordService&&) = delete;
PasswordService& operator=(PasswordService&&) = delete;
// Password services
@@ -90,11 +90,8 @@ namespace Auth {
private:
std::shared_timed_mutex _passwordCheckMutex;
std::shared_timed_mutex _tokenCheckMutex;
LoginThrottler _passwordLoginThrottler;
LoginThrottler _tokenLoginThrottler;
std::shared_timed_mutex _mutex;
LoginThrottler _loginThrottler;
};
}
src/main/main.cpp
+4 -2
View File
@@ -26,7 +26,8 @@
#include "api/subsonic/SubsonicResource.hpp"
#include "av/AvInfo.hpp"
#include "av/AvTranscoder.hpp"
#include "auth/AuthService.hpp"
#include "auth/AuthTokenService.hpp"
#include "auth/PasswordService.hpp"
#include "cover/CoverArtGrabber.hpp"
#include "image/Image.hpp"
#include "scanner/MediaScanner.hpp"
@@ -129,7 +130,8 @@ int main(int argc, char* argv[])
UserInterface::LmsApplicationGroupContainer appGroups;
// Service initialization order is important
ServiceProvider<Auth::AuthService>::create(getService<Config>()->getULong("login-throttler-max-entriees", 10000));
ServiceProvider<Auth::AuthTokenService>::create(getService<Config>()->getULong("login-throttler-max-entriees", 10000));
ServiceProvider<Auth::PasswordService>::create(getService<Config>()->getULong("login-throttler-max-entriees", 10000));
Scanner::MediaScanner& mediaScanner {ServiceProvider<Scanner::MediaScanner>::create(database.createSession())};
Similarity::FeaturesScannerAddon similarityFeaturesScannerAddon {database.createSession()};
src/ui/Auth.cpp
+11 -10
View File
@@ -27,7 +27,8 @@
#include <Wt/WPushButton.h>
#include <Wt/WRandom.h>
#include "auth/AuthService.hpp"
#include "auth/AuthTokenService.hpp"
#include "auth/PasswordService.hpp"
#include "main/Service.hpp"
#include "utils/Logger.hpp"
@@ -42,7 +43,7 @@ static
void
createAuthToken(Database::IdType userId, const Wt::WDateTime& expiry)
{
const std::string secret {getService<::Auth::AuthService>()->createAuthToken(LmsApp->getDbSession(), userId, expiry)};
const std::string secret {getService<::Auth::AuthTokenService>()->createAuthToken(LmsApp->getDbSession(), userId, expiry)};
LmsApp->setCookie(authCookieName,
secret,
@@ -60,15 +61,15 @@ processAuthToken(const Wt::WEnvironment& env)
if (!authCookie)
return boost::none;
const auto res {getService<::Auth::AuthService>()->processAuthToken(LmsApp->getDbSession(), boost::asio::ip::address::from_string(env.clientAddress()), *authCookie)};
const auto res {getService<::Auth::AuthTokenService>()->processAuthToken(LmsApp->getDbSession(), boost::asio::ip::address::from_string(env.clientAddress()), *authCookie)};
switch (res.state)
{
case ::Auth::AuthService::AuthTokenProcessResult::State::NotFound:
case ::Auth::AuthService::AuthTokenProcessResult::State::Throttled:
case ::Auth::AuthTokenService::AuthTokenProcessResult::State::NotFound:
case ::Auth::AuthTokenService::AuthTokenProcessResult::State::Throttled:
LmsApp->setCookie(authCookieName, std::string {}, 0, "", "", env.urlScheme() == "https");
return boost::none;
case ::Auth::AuthService::AuthTokenProcessResult::State::Found:
case ::Auth::AuthTokenService::AuthTokenProcessResult::State::Found:
createAuthToken(res.authTokenInfo->userId, res.authTokenInfo->expiry);
break;
}
@@ -124,18 +125,18 @@ class AuthModel : public Wt::WFormModel
if (field == PasswordField)
{
switch (getService<::Auth::AuthService>()->checkUserPassword(
switch (getService<::Auth::PasswordService>()->checkUserPassword(
LmsApp->getDbSession(),
boost::asio::ip::address::from_string(LmsApp->environment().clientAddress()),
valueText(LoginNameField).toUTF8(),
valueText(PasswordField).toUTF8()))
{
case ::Auth::AuthService::PasswordCheckResult::Match:
case ::Auth::PasswordService::PasswordCheckResult::Match:
break;
case ::Auth::AuthService::PasswordCheckResult::Mismatch:
case ::Auth::PasswordService::PasswordCheckResult::Mismatch:
error = Wt::WString::tr("Lms.password-bad-login-combination");
break;
case ::Auth::AuthService::PasswordCheckResult::Throttled:
case ::Auth::PasswordService::PasswordCheckResult::Throttled:
error = Wt::WString::tr("Lms.password-client-throttled");
break;
}
src/ui/SettingsView.cpp
+3 -3
View File
@@ -31,7 +31,7 @@
#include "common/Validators.hpp"
#include "common/ValueStringModel.hpp"
#include "auth/AuthService.hpp"
#include "auth/PasswordService.hpp"
#include "main/Service.hpp"
#include "utils/Logger.hpp"
#include "LmsApplication.hpp"
@@ -75,7 +75,7 @@ class SettingsModel : public Wt::WFormModel
Database::User::PasswordHash passwordHash;
if (!valueText(PasswordField).empty())
passwordHash = getService<::Auth::AuthService>()->hashPassword(valueText(PasswordField).toUTF8());
passwordHash = getService<::Auth::PasswordService>()->hashPassword(valueText(PasswordField).toUTF8());
auto transaction {LmsApp->getDbSession().createUniqueTransaction()};
@@ -125,7 +125,7 @@ class SettingsModel : public Wt::WFormModel
{
if (!valueText(PasswordField).empty())
{
if (!getService<::Auth::AuthService>()->evaluatePasswordStrength(LmsApp->getUserLoginName(), valueText(PasswordField).toUTF8()))
if (!getService<::Auth::PasswordService>()->evaluatePasswordStrength(LmsApp->getUserLoginName(), valueText(PasswordField).toUTF8()))
error = Wt::WString::tr("Lms.password-too-weak");
}
else
src/ui/admin/InitWizardView.cpp
+3 -3
View File
@@ -23,7 +23,7 @@
#include <Wt/WLineEdit.h>
#include <Wt/WPushButton.h>
#include "auth/AuthService.hpp"
#include "auth/PasswordService.hpp"
#include "main/Service.hpp"
#include "utils/Exception.hpp"
#include "utils/Logger.hpp"
@@ -55,7 +55,7 @@ class InitWizardModel : public Wt::WFormModel
void saveData()
{
const Database::User::PasswordHash passwordHash {getService<::Auth::AuthService>()->hashPassword(valueText(PasswordField).toUTF8())};
const Database::User::PasswordHash passwordHash {getService<::Auth::PasswordService>()->hashPassword(valueText(PasswordField).toUTF8())};
auto transaction(LmsApp->getDbSession().createUniqueTransaction());
@@ -77,7 +77,7 @@ class InitWizardModel : public Wt::WFormModel
if (!valueText(PasswordField).empty())
{
// Evaluate the strength of the password
if (!getService<::Auth::AuthService>()->evaluatePasswordStrength(valueText(AdminLoginField).toUTF8(), valueText(PasswordField).toUTF8()))
if (!getService<::Auth::PasswordService>()->evaluatePasswordStrength(valueText(AdminLoginField).toUTF8(), valueText(PasswordField).toUTF8()))
error = Wt::WString::tr("Lms.password-too-weak");
}
else
src/ui/admin/UserView.cpp
+3 -3
View File
@@ -28,7 +28,7 @@
#include <Wt/WFormModel.h>
#include "auth/AuthService.hpp"
#include "auth/PasswordService.hpp"
#include "database/User.hpp"
#include "main/Service.hpp"
#include "utils/Config.hpp"
@@ -82,7 +82,7 @@ class UserModel : public Wt::WFormModel
{
boost::optional<Database::User::PasswordHash> passwordHash;
if (!valueText(PasswordField).empty())
passwordHash = getService<::Auth::AuthService>()->hashPassword(valueText(PasswordField).toUTF8());
passwordHash = getService<::Auth::PasswordService>()->hashPassword(valueText(PasswordField).toUTF8());
auto transaction {LmsApp->getDbSession().createUniqueTransaction()};
@@ -172,7 +172,7 @@ class UserModel : public Wt::WFormModel
else
{
// Evaluate the strength of the password for non demo accounts
if (!getService<::Auth::AuthService>()->evaluatePasswordStrength(getLoginName(), valueText(PasswordField).toUTF8()))
if (!getService<::Auth::PasswordService>()->evaluatePasswordStrength(getLoginName(), valueText(PasswordField).toUTF8()))
error = Wt::WString::tr("Lms.password-too-weak");
}
}