@@ -9,7 +9,6 @@ gifts that any member of the family received for Christmas. * ruby * rubygems * postgresql -* openssl binary (used for salt generation) * ruby-pg, ruby-postgres, or postgres-pr * sinatra (0.3.1) * sequel (git HEAD) README @@ -9,7 +9,13 @@ class User < Sequel::Model end def password=(pass) - self.salt = `openssl rand -hex 20` + self.salt = new_salt self[:password] = ::Digest::SHA1.new.update(salt).update(pass).hexdigest end + + private + + def new_salt + (0...40).map{(i = Kernel.rand(62); i += ((i < 10) ? 48 : ((i < 36) ? 55 : 61 ))).chr}.join + end end models/user.rb @@ -164,7 +164,7 @@ describe User do salt = @user.salt @user.password = 'blah' @user.salt.should_not == salt - @user.salt.should =~ /\A[0-9a-f]{40}\z/ + @user.salt.should =~ /\A[0-9a-zA-Z]{40}\z/ end specify "#password= should set the SHA1 password hash based on the salt and password" do spec/unit.rb 136299aebffae943d8f5fbc16f55b8f390575fbe Jeremy Evans code@jeremyevans.net http://github.com/jeremyevans/giftsmas/commit/bc8a0131ce8d6719735cc56841a06f8e65b7dc34 bc8a0131ce8d6719735cc56841a06f8e65b7dc34 2008-12-18T14:58:02-08:00 2008-12-18T14:58:02-08:00 Use ruby for salt generation instead of shelling out to openssl, for portability reasons a11f71db1b39afcb73903e54dfd9c462f99b1ca0 Jeremy Evans code@jeremyevans.net