Extend password support for admin/reseller users

[stefanpejcic]

based on #737

admin password is limited to 5-30 a-z 0-9 characters, simply because I was too lazy to do proper validations and escaping when adding them to sqlite db

to fully support any character in admin passwords, we need to edit:

• admin.sh
• install.sh
• form validations on administrators.html and password_reseller.html password_admin.html
• back validations on administrators.py

[frussane]

@stefanpejcic How could I be able to assist on the .py file since it's closed source?

[stefanpejcic]

python is the last thing to be edited, it just runs opencli admin commands, so admin.sh is the main thing that should be edited, then front validations and last the py file

[stefanpejcic]

here is administrators.py

only this part needs editing

        # https://github.com/stefanpejcic/OpenPanel/issues/737
        if username and not re.match(r'^[A-Za-z0-9]+$', username):
            flash('Error: Username can only contain letters and numbers. Docs: https://openpanel.com/docs/articles/accounts/forbidden-usernames/#openadmin', 'error')
            return redirect(request.url)
        if password and not re.match(r'^[A-Za-z0-9]+$', password):
            flash('Error: Password can only contain letters and numbers. Docs: https://openpanel.com/docs/articles/accounts/forbidden-usernames/#openadmin', 'error')
            return redirect(request.url)

[frussane]

@stefanpejcic I was taking a look at the code, since we're using a password hash, shouldn't it be already special chars safe?
Because we'll always hash the password before inserting it into sqlite db. So we'd just need to actually relax the validations, and no real escaping is needed, right?

[frussane]

@stefanpejcic I just remembered that in bash it's all in one line, so we either force users to put passwords inside quotes, or else bash can interpert wrong stuff. But we can't force users to actually do this. The best solution would be to actually have bash ask for the password in seperate commands, but this would probably break a lot of what you already have integrated with the GUI, right?

I'm trying to think of an elegant solution that ensures current compability...

[stefanpejcic]

yes, you are absolutely right, its already hashed so would not be an issue..

I think the smart move here is to do same ad for the openpanel user passwords:

• from user/admin panels python escapes, hashes and saves directly avoiding bash and opencli
• from terminal this wont work without '' or ""

same on admin panel would cover most cases: openadmin gui and api, while terminal would still fail - so for now lets just keep admin.sh and install.sh as is, to avoid bash, but just change messages to indicate that complex passwords need to be set via gui/api. And edit python to handle it from admin panel when needed

[frussane]

Awesome @stefanpejcic
I see that on password_reseller.html you already allow everything except apostrophes.

Can we make it equal across all 3 pages? Is there any problems using apostrophes on the GUI?
I would suggest using this:
pattern="[\S]{5,30}"
Which would permit everything but not spaces.

Also changing the generateRandomStrongPassword charset to include some special chars.

Also, for the sake of modular programming, can't we have a password_generator.js file that's imported, instead of repeating code on the 3 pages?

[stefanpejcic]

yes, eventually when refactoring the code this will all be merged in a single function in separate js file

like user panel has static/js/generator.js

// user, db_name, pass generator
function generateString(length) {
    const charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
    let randomString = "";
    for (let i = 0; i < length; i++) {
        const randomIndex = Math.floor(Math.random() * charset.length);
        randomString += charset.charAt(randomIndex);
    }
    return randomString;
}