github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-05-22 16:21:18 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

SECURITY: Limit passwords to 200 characters

Browse Source 
Prevents layer 8 attack.
This commit is contained in:
riking
2014-09-11 12:22:11 -07:00
committed by Robin Ward
parent 216ee9f2f1
commit 2c6d03f87f
8 changed files with 78 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
app/controllers/users_controller.rb
View File

@ -151,6 +151,11 @@ class UsersController < ApplicationController
return
end
if params[:password] && params[:password].length > User.max_password_length
render json: { success: false, message: I18n.t("login.password_too_long") }
return
end
user = User.new(user_params)
authentication = UserAuthenticator.new(user, session)
@ -221,12 +226,17 @@ class UsersController < ApplicationController
if !@user
flash[:error] = I18n.t('password_reset.no_token')
elsif request.put?
raise Discourse::InvalidParameters.new(:password) unless params[:password].present?
@user.password = params[:password]
@user.password_required!
if @user.save
Invite.invalidate_for_email(@user.email) # invite link can't be used to log in anymore
logon_after_password_reset
@invalid_password = params[:password].blank? || params[:password].length > User.max_password_length
if @invalid_password
@user.errors.add(:password, :invalid)
else
@user.password = params[:password]
@user.password_required!
if @user.save
Invite.invalidate_for_email(@user.email) # invite link can't be used to log in anymore
logon_after_password_reset
end
end
end
render layout: 'no_js'