tonyair/silverstripe-framework
1
0
Fork 0
mirror of https://github.com/silverstripe/silverstripe-framework synced 2024-10-22 14:05:37 +02:00
Code Issues Projects Releases Wiki Activity

FIX Update meber passwordencryption to default on password change

Browse Source
This commit is contained in:
Daniel Hensby 2017-11-23 20:28:25 +00:00
parent 79bba8bfd1
commit 2ad3cc07d5
No known key found for this signature in database
GPG Key ID: B00D1E9767F0B06E
2 changed files with 18 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
security/Member.php
View File

@ -975,8 +975,7 @@ class Member extends DataObject implements TemplateGlobalProvider {
$encryption_details = Security::encrypt_password(
$this->Password, // this is assumed to be cleartext
$this->Salt,
($this->PasswordEncryption) ?
$this->PasswordEncryption : Security::config()->password_encryption_algorithm,
$this->isChanged('PasswordEncryption') ? $this->PasswordEncryption : null,
$this
);

42
tests/security/MemberTest.php
View File

@ -45,7 +45,21 @@ class MemberTest extends FunctionalTest {
parent::tearDown();
}
public function testPasswordEncryptionUpdatedOnChangedPassword()
{
Config::inst()->update('Security', 'password_encryption_algorithm', 'none');
$member = Member::create();
$member->SetPassword = 'password';
$member->write();
$this->assertEquals('password', $member->Password);
$this->assertEquals('none', $member->PasswordEncryption);
Config::inst()->update('Security', 'password_encryption_algorithm', 'blowfish');
$member->SetPassword = 'newpassword';
$member->write();
$this->assertNotEquals('password', $member->Password);
$this->assertNotEquals('newpassword', $member->Password);
$this->assertEquals('blowfish', $member->PasswordEncryption);
}
/**
* @expectedException ValidationException
@ -94,28 +108,6 @@ class MemberTest extends FunctionalTest {
);
}
public function testDefaultPasswordEncryptionDoesntChangeExistingMembers() {
$member = new Member();
$member->Password = 'mypassword';
$member->PasswordEncryption = 'sha1_v2.4';
$member->write();
$origAlgo = Security::config()->password_encryption_algorithm;
Security::config()->password_encryption_algorithm = 'none';
$member->Password = 'mynewpassword';
$member->write();
$this->assertEquals(
$member->PasswordEncryption,
'sha1_v2.4'
);
$result = $member->checkPassword('mynewpassword');
$this->assertTrue($result->valid());
Security::config()->password_encryption_algorithm = $origAlgo;
}
public function testKeepsEncryptionOnEmptyPasswords() {
$member = new Member();
$member->Password = 'mypassword';
@ -126,8 +118,8 @@ class MemberTest extends FunctionalTest {
$member->write();
$this->assertEquals(
$member->PasswordEncryption,
'sha1_v2.4'
Security::config()->get('password_encryption_algorithm'),
$member->PasswordEncryption
);
$result = $member->checkPassword('');
$this->assertTrue($result->valid());