/synapse

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Already on GitHub? Sign in to your account

Add an admin option to shared secret registration (breaks backwards compat) #909

Merged
merged 6 commits into from Jul 6, 2016

Conversation

Reviewers
No reviews
Assignees

@NegativeMjark NegativeMjark

Labels
None yet
Projects
None yet
Milestone
No milestone
2 participants
@erikjohnston @NegativeMjark
@erikjohnston
Owner

erikjohnston commented Jul 5, 2016

No description provided.

erikjohnston added some commits Jul 5, 2016

@erikjohnston
Protect password when registering using shared secret
caf33b2
@erikjohnston
Add an admin option to shared secret registration

Some checks were not successful

2 errored, 2 failing, and 6 successful checks
@matrixbot
Sytest Dendron (Commit) — Build #219 origin/erikj/shared_secret failed in 53 sec
Details
@matrixbot
Sytest Postgres (Commit) — Build #1059 origin/erikj/shared_secret failed in 44 sec
Details
@matrixbot
Sytest Dendron (Merged PR) — Build finished.
Details
@matrixbot
Sytest Postgres (Merged PR) — Build finished.
Details
@matrixbot
Flake8 + Packaging (Commit) — Build #1103 origin/erikj/shared_secret succeeded in 35 sec
Details
@matrixbot
Flake8 + Packaging (Merged PR) — Build finished.
Details
@matrixbot
Sytest SQLite (Commit) — Build #1075 origin/erikj/shared_secret succeeded in 4 min 21 sec
Details
@matrixbot
Sytest SQLite (Merged PR) — Build finished.
Details
@matrixbot
Unit Tests (Commit) — Build #1142 origin/erikj/shared_secret succeeded in 1 min 14 sec
Details
@matrixbot
Unit Tests (Merged PR) — Build finished.
Details
651faee

@erikjohnston erikjohnston assigned NegativeMjark Jul 5, 2016

erikjohnston added some commits Jul 5, 2016

@erikjohnston
Fix for postgres

Some checks were not successful

2 errored, 2 failing, and 6 successful checks
@matrixbot
Sytest Dendron (Commit) — Build #220 origin/erikj/shared_secret failed in 6 min 22 sec
Details
@matrixbot
Sytest Postgres (Commit) — Build #1060 origin/erikj/shared_secret failed in 6 min 19 sec
Details
@matrixbot
Sytest Dendron (Merged PR) — Build finished.
Details
@matrixbot
Sytest Postgres (Merged PR) — Build finished.
Details
@matrixbot
Flake8 + Packaging (Commit) — Build #1104 origin/erikj/shared_secret succeeded in 33 sec
Details
@matrixbot
Flake8 + Packaging (Merged PR) — Build finished.
Details
@matrixbot
Sytest SQLite (Commit) — Build #1076 origin/erikj/shared_secret succeeded in 5 min 52 sec
Details
@matrixbot
Sytest SQLite (Merged PR) — Build finished.
Details
@matrixbot
Unit Tests (Commit) — Build #1143 origin/erikj/shared_secret succeeded in 1 min 14 sec
Details
@matrixbot
Unit Tests (Merged PR) — Build finished.
Details
4adf93e
@erikjohnston
Remove spurious txn

All checks have passed

10 successful checks
@matrixbot
Flake8 + Packaging (Commit) — Build #1105 origin/erikj/shared_secret succeeded in 33 sec
Details
@matrixbot
Flake8 + Packaging (Merged PR) — Build finished.
Details
@matrixbot
Sytest Dendron (Commit) — Build #221 origin/erikj/shared_secret succeeded in 6 min 22 sec
Details
@matrixbot
Sytest Dendron (Merged PR) — Build finished.
Details
@matrixbot
Sytest Postgres (Commit) — Build #1061 origin/erikj/shared_secret succeeded in 6 min 11 sec
Details
@matrixbot
Sytest Postgres (Merged PR) — Build finished.
Details
@matrixbot
Sytest SQLite (Commit) — Build #1077 origin/erikj/shared_secret succeeded in 5 min 44 sec
Details
@matrixbot
Sytest SQLite (Merged PR) — Build finished.
Details
@matrixbot
Unit Tests (Commit) — Build #1144 origin/erikj/shared_secret succeeded in 1 min 32 sec
Details
@matrixbot
Unit Tests (Merged PR) — Build finished.
Details
be3548f

@NegativeMjark NegativeMjark and 1 other commented on an outdated diff Jul 6, 2016

View full outdated diff
synapse/rest/client/v1/register.py
digestmod=sha1,
- ).hexdigest()
-
- password = register_json["password"].encode("utf-8")
+ )
+ want_mac.update(user)
+ want_mac.update(password)
+ want_mac.update("admin" if admin else "notadmin")
@NegativeMjark

NegativeMjark Jul 6, 2016

Contributor

What happens if someone creates a user with password = "password" and admin=False and then someone nicks their mac and registers a user with password = "passwordnot" and admin=True?

@NegativeMjark

NegativeMjark Jul 6, 2016

Contributor

Similar thoughts on shifting characters between the "user" and "password" fields.

@erikjohnston

erikjohnston Jul 6, 2016

Owner

Yeah, leo just brought that up in the sytest PR. I've added null separators, which I think makes it fine?
@erikjohnston
Add null separator to hmac

All checks have passed

10 successful checks
@matrixbot
Flake8 + Packaging (Commit) — Build #1107 origin/erikj/shared_secret succeeded in 32 sec
Details
@matrixbot
Flake8 + Packaging (Merged PR) — Build finished.
Details
@matrixbot
Sytest Dendron (Commit) — Build #223 origin/erikj/shared_secret succeeded in 6 min 16 sec
Details
@matrixbot
Sytest Dendron (Merged PR) — Build finished.
Details
@matrixbot
Sytest Postgres (Commit) — Build #1063 origin/erikj/shared_secret succeeded in 6 min 11 sec
Details
@matrixbot
Sytest Postgres (Merged PR) — Build finished.
Details
@matrixbot
Sytest SQLite (Commit) — Build #1080 origin/erikj/shared_secret succeeded in 5 min 51 sec
Details
@matrixbot
Sytest SQLite (Merged PR) — Build finished.
Details
@matrixbot
Unit Tests (Commit) — Build #1146 origin/erikj/shared_secret succeeded in 1 min 26 sec
Details
@matrixbot
Unit Tests (Merged PR) — Build finished.
Details
0da24ca

@erikjohnston erikjohnston referenced this pull request in matrix-org/sytest Jul 6, 2016

Merged

Test registering via shared secret #259

@erikjohnston
Check that there are no null bytes in user and passsword

All checks have passed

10 successful checks
@matrixbot
Flake8 + Packaging (Commit) — Build #1109 origin/erikj/shared_secret succeeded in 34 sec
Details
@matrixbot
Flake8 + Packaging (Merged PR) — Build finished.
Details
@matrixbot
Sytest Dendron (Commit) — Build #224 origin/erikj/shared_secret succeeded in 6 min 14 sec
Details
@matrixbot
Sytest Dendron (Merged PR) — Build finished.
Details
@matrixbot
Sytest Postgres (Commit) — Build #1064 origin/erikj/shared_secret succeeded in 5 min 38 sec
Details
@matrixbot
Sytest Postgres (Merged PR) — Build finished.
Details
@matrixbot
Sytest SQLite (Commit) — Build #1082 origin/erikj/shared_secret succeeded in 5 min 41 sec
Details
@matrixbot
Sytest SQLite (Merged PR) — Build finished.
Details
@matrixbot
Unit Tests (Commit) — Build #1148 origin/erikj/shared_secret succeeded in 1 min 31 sec
Details
@matrixbot
Unit Tests (Merged PR) — Build finished.
Details
76b18df
@NegativeMjark
Contributor

NegativeMjark commented Jul 6, 2016

Looks like it might work.

@erikjohnston erikjohnston merged commit f0c06ac into develop Jul 6, 2016
10 checks passed

10 checks passed

Flake8 + Packaging (Commit) Build #1109 origin/erikj/shared_secret succeeded in 34 sec
Details
Flake8 + Packaging (Merged PR) Build finished.
Details
Sytest Dendron (Commit) Build #224 origin/erikj/shared_secret succeeded in 6 min 14 sec
Details
Sytest Dendron (Merged PR) Build finished.
Details
Sytest Postgres (Commit) Build #1064 origin/erikj/shared_secret succeeded in 5 min 38 sec
Details
Sytest Postgres (Merged PR) Build finished.
Details
Sytest SQLite (Commit) Build #1082 origin/erikj/shared_secret succeeded in 5 min 41 sec
Details
Sytest SQLite (Merged PR) Build finished.
Details
Unit Tests (Commit) Build #1148 origin/erikj/shared_secret succeeded in 1 min 31 sec
Details
Unit Tests (Merged PR) Build finished.
Details

@richvdh richvdh deleted the erikj/shared_secret branch Dec 1, 2016

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment