Skip to content

Riina Antikainen / Moya

Go to a project
Commit 2d798437 by Juho Juopperi
Options

Password hashing

1 parent 5fd77e44
Expand all
Inline Side-by-side
Showing with 165 additions and 3 deletions
code/LanBortalDatabase/.classpath
......@@ -12,5 +12,6 @@
<attribute name="owner.project.facets" value="jst.java"/>
</attributes>
</classpathentry>
<classpathentry combineaccessrules="false" kind="src" path="/commons-codec-1.4"/>
<classpathentry kind="output" path="build/classes"/>
</classpath>
code/LanBortalDatabase/src/fi/insomnia/bortal/model/User.java
......@@ -4,8 +4,12 @@
*/
package fi.insomnia.bortal.model;
import java.io.UnsupportedEncodingException;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.util.Calendar;
import java.util.List;
import java.util.Random;
import javax.persistence.CascadeType;
import javax.persistence.Column;
......@@ -22,6 +26,11 @@ import javax.persistence.Temporal;
import javax.persistence.TemporalType;
import javax.persistence.Version;
import org.apache.commons.codec.binary.Base64;
import org.apache.commons.codec.digest.DigestUtils;
import sun.misc.BASE64Decoder;
/**
*
*/
......@@ -29,7 +38,6 @@ import javax.persistence.Version;
@Table(name = "users")
@NamedQueries( {
@NamedQuery(name = "User.findAll", query = "SELECT u FROM User u"),
@NamedQuery(name = "User.findByCreated", query = "SELECT u FROM User u WHERE u.created = :created"),
@NamedQuery(name = "User.findByActive", query = "SELECT u FROM User u WHERE u.active = :active"),
@NamedQuery(name = "User.findByPassword", query = "SELECT u FROM User u WHERE u.password = :password"),
......@@ -523,7 +531,49 @@ public class User implements ModelInterface<Integer> {
this.eventSettings = eventSettings;
}
public static String hashPassword(String plainPassword) {
throw new UnsupportedOperationException("TÄLLE EI SAA TEHDÄ TESTIMETODIA, KOSKA SE KUITENKIN UNOGTUU TÄNNE");
public static String hashPassword(String plainPassword) throws NoSuchAlgorithmException {
return null;
}
public void setPlainPassword(String password) {
String salt = generateSalt();
String base64Str = shaWithSaltToBase64(password, salt);
String ssha = "{SSHA}" + base64Str;
setPassword(ssha);
}
private String shaWithSaltToBase64(String password, String salt) {
String hashed = new String(DigestUtils.sha(password + salt));
String both = hashed + salt;
String base64Str = Base64.encodeBase64String(both.getBytes());
return base64Str;
}
public boolean checkPlainPassword(String password) {
String oldEncryptedPassword = getPassword();
String oldBase64 = oldEncryptedPassword.substring("{SSHA}".length());
String oldHashedAndSalt = new String(Base64.decodeBase64(oldBase64));
String salt = oldHashedAndSalt.substring(
oldHashedAndSalt.length() - getSaltLenght(),
oldHashedAndSalt.length());
String newBase64 = shaWithSaltToBase64(password, salt);
boolean theSame = oldBase64.equals(newBase64);
return theSame;
}
private int getSaltLenght() {
return 8;
}
private String generateSalt() {
Random random = new Random();
String lettahs = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
StringBuilder sb = new StringBuilder();
for (int i = 0; i < getSaltLenght(); i++) {
int index = random.nextInt(lettahs.length());
sb.append(lettahs.charAt(index));
}
return sb.toString();
}
}
code/lib/commons-codec-1.4/.classpath 0 → 100644
<?xml version="1.0" encoding="UTF-8"?>
<classpath>
<classpathentry kind="con" path="org.eclipse.jdt.launching.JRE_CONTAINER/org.eclipse.jdt.internal.debug.ui.launcher.StandardVMType/JavaSE-1.6"/>
<classpathentry exported="true" kind="lib" path="commons-codec-1.4.jar" sourcepath="commons-codec-1.4-sources.jar">
<attributes>
<attribute name="javadoc_location" value="jar:platform:/resource/commons-codec-1.4/commons-codec-1.4-javadoc.jar!/"/>
</attributes>
</classpathentry>
<classpathentry kind="output" path="bin"/>
</classpath>
code/lib/commons-codec-1.4/.project 0 → 100644
<?xml version="1.0" encoding="UTF-8"?>
<projectDescription>
<name>commons-codec-1.4</name>
<comment></comment>
<projects>
</projects>
<buildSpec>
<buildCommand>
<name>org.eclipse.jdt.core.javabuilder</name>
<arguments>
</arguments>
</buildCommand>
</buildSpec>
<natures>
<nature>org.eclipse.jdt.core.javanature</nature>
</natures>
</projectDescription>
code/lib/commons-codec-1.4/.settings/org.eclipse.jdt.core.prefs 0 → 100644
#Sun Mar 21 05:38:16 EET 2010
eclipse.preferences.version=1
org.eclipse.jdt.core.compiler.codegen.inlineJsrBytecode=enabled
org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.6
org.eclipse.jdt.core.compiler.codegen.unusedLocal=preserve
org.eclipse.jdt.core.compiler.compliance=1.6
org.eclipse.jdt.core.compiler.debug.lineNumber=generate
org.eclipse.jdt.core.compiler.debug.localVariable=generate
org.eclipse.jdt.core.compiler.debug.sourceFile=generate
org.eclipse.jdt.core.compiler.problem.assertIdentifier=error
org.eclipse.jdt.core.compiler.problem.enumIdentifier=error
org.eclipse.jdt.core.compiler.source=1.6
code/lib/commons-codec-1.4/NOTICE.txt 0 → 100644
Apache Commons Codec
Copyright 2002-2009 The Apache Software Foundation
This product includes software developed by
The Apache Software Foundation (http://www.apache.org/).
--------------------------------------------------------------------------------
src/test/org/apache/commons/codec/language/DoubleMetaphoneTest.java contains
test data from http://aspell.sourceforge.net/test/batch0.tab.
Copyright (C) 2002 Kevin Atkinson (kevina@gnu.org). Verbatim copying
and distribution of this entire article is permitted in any medium,
provided this notice is preserved.
--------------------------------------------------------------------------------
code/lib/commons-codec-1.4/RELEASE-NOTES.txt 0 → 100644
$Id: RELEASE-NOTES.txt 801709 2009-08-06 16:31:27Z niallp $
Commons Codec Package
Version 1.4
Release Notes
http://commons.apache.org/codec/
The codec package contains simple encoder and decoders for various formats
such as Base64 and Hexadecimal. In addition to these widely used encoders and
decoders, the codec package also maintains a collection of phonetic encoding
utilities.
Compatibility
o Codec 1.4 is binary compatible with Codec 1.3
o Codec 1.4 has a minimum requirement of JDK 1.4
Changes in this version include:
New Features:
o [CODEC-60] Implement Caverphone.
o [CODEC-52] Digest on InputStreams.
o [CODEC-39] DigestUtils: Add methods for SHA-256, SHA-384, and SHA-512.
o [CODEC-69] Streaming Base64 (Base64InputStream and Base64OutputStream added).
o [CODEC-59] Add methods to Base64 which work with String instead of byte[]
Fixed bugs:
o [CODEC-77] Base64 bug with empty input (new byte[0]).
o [CODEC-72] Soundex and RefinedSoundex issues with character arrays.
o [CODEC-71] Base64.isArrayByteBase64() method is inefficient for large byte arrays.
o [CODEC-70] Thread safety and malicious code safety improvements.
o [CODEC-68] isBase64 throws ArrayIndexOutOfBoundsException on some non-BASE64 bytes.
o [CODEC-65] Fix case-insensitive string handling.
o [CODEC-61] Base64.encodeBase64() throws NegativeArraySizeException on large files.
o [CODEC-58] Character set used by Base64 not documented.
o [CODEC-56] RefinedSoundex creates instance before al fields have been initialized.
o [CODEC-51] Test failures in SoundexTest
o [CODEC-10] Using US_ENGLISH in Soundex caused an NullPointerException.
o [CODEC-6] Source tarball spews files all over the place.
o [CODEC-22] Base64.isArrayByteBase64() throws an ArrayIndexOutOfBoundsException for negative octets
o [CODEC-78] Base64: Improve Code Coverage
o [CODEC-81] Base64's new constructor parameters ignored
o [CODEC-83] Improve Double Metaphone test coverage
o [CODEC-84] Double Metaphone bugs in alternative encoding
o [CODEC-73] Make string2byte conversions indepedent of platform default encoding
Changes:
o [CODEC-75] Make Base64 URL-safe
o [CODEC-74] Allow for uppercase letters output in Hex.encodeHex().
o [CODEC-40] Add crypto-compatible BigInteger encoding support to Base64.
Have fun!
-The commons-codec team
\ No newline at end of file
Markdown is supported
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!