Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

webui: crypt user password by default before passing it to backend #5321

Closed
wants to merge 1 commit into from
Closed

webui: crypt user password by default before passing it to backend #5321

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 7 additions & 3 deletions ui/webui/src/components/AnacondaWizard.jsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ import { getDefaultScenario } from "./storage/InstallationScenario.jsx";
import { MountPointMapping, getPageProps as getMountPointMappingProps } from "./storage/MountPointMapping.jsx";
import { DiskEncryption, getStorageEncryptionState, getPageProps as getDiskEncryptionProps } from "./storage/DiskEncryption.jsx";
import { InstallationLanguage, getPageProps as getInstallationLanguageProps } from "./localization/InstallationLanguage.jsx";
import { Accounts, getPageProps as getAccountsProps, getAccountsState, accountsToDbusUsers } from "./users/Accounts.jsx";
import { Accounts, getPageProps as getAccountsProps, getAccountsState, accountsToDbusUsers, cryptUserPassword } from "./users/Accounts.jsx";
import { InstallationProgress } from "./installation/InstallationProgress.jsx";
import { ReviewConfiguration, ReviewConfigurationConfirmModal, getPageProps as getReviewConfigurationProps } from "./review/ReviewConfiguration.jsx";
import { exitGui } from "../helpers/exit.js";
Expand Down Expand Up @@ -362,8 +362,12 @@ const Footer = ({
},
});
} else if (activeStep.id === "accounts") {
setUsers(accountsToDbusUsers(accounts));
onNext();
cryptUserPassword(accounts.password)
.then(cryptedPassword => {
const users = accountsToDbusUsers({ ...accounts, password: cryptedPassword });
setUsers(users);
onNext();
}, onCritFail({ context: N_("Password ecryption failed.") }));
} else {
onNext();
}
Expand Down
8 changes: 7 additions & 1 deletion ui/webui/src/components/users/Accounts.jsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,12 +45,18 @@ export function getAccountsState (
};
}

export const cryptUserPassword = async (password) => {
const pythonScript = `from random import SystemRandom as sr; import crypt; print(crypt.crypt("${password}", "$y$j9T$" + "".join(sr().choice("./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz") for _sc in range(24))))`;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The crypt module will be removed in Python 3.13, which is planned/proposed for Fedora 41: https://discussion.fedoraproject.org/t/f41-change-proposal-python-3-13-system-wide/92897
So this code might stop working quite soon. Unfortunately, I do not come with another solution.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would prefer to address it out of scope of this PR together with the GUI implementation:

anaconda/pyanaconda/core/users.py

Line 40 in c25d1fe

def crypt_password(password):

const crypted = await cockpit.spawn(["python3", "-c", pythonScript]);
return crypted;
};

export const accountsToDbusUsers = (accounts) => {
return [{
name: cockpit.variant("s", accounts.userAccount || ""),
gecos: cockpit.variant("s", accounts.fullName || ""),
password: cockpit.variant("s", accounts.password || ""),
"is-crypted": cockpit.variant("b", false),
"is-crypted": cockpit.variant("b", true),
groups: cockpit.variant("as", ["wheel"]),
}];
};
Expand Down
3 changes: 1 addition & 2 deletions ui/webui/test/check-users
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,8 +44,7 @@ class TestUsers(anacondalib.VirtInstallMachineCase):

users = u.dbus_get_users()
self.assertIn('"groups" as 1 "wheel"', users)
self.assertIn('"is-crypted" b false', users)
self.assertIn('"password" s "password"', users)
self.assertIn('"is-crypted" b true', users)

if __name__ == '__main__':
test_main()