IT4Change/gradido
3
0
Fork 0
mirror of https://github.com/IT4Change/gradido.git synced 2025-12-13 07:45:54 +00:00
Code Issues Packages Projects Releases Wiki Activity

add option unsecure.allow_all_passwords to disable password restrictions and allow any type of passwords (even empty ones)

Browse Source
This commit is contained in:
einhornimmond 2021-02-26 16:25:00 +01:00 committed by Ulf Gebhardt
parent 30ff0a84ef
commit a567bd3780
No known key found for this signature in database
GPG Key ID: 81308EFE29ABFEBD
4 changed files with 105 additions and 97 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

192
src/cpp/JSONInterface/JsonCreateUser.cpp
View File

@ -1,97 +1,97 @@
#include "JsonCreateUser.h"
#include "../model/email/Email.h"
#include "../controller/User.h"
#include "../controller/EmailVerificationCode.h"
#include "../SingletonManager/EmailManager.h"
#include "../SingletonManager/SessionManager.h"
#include "../tasks/AuthenticatedEncryptionCreateKeyTask.h"
Poco::JSON::Object* JsonCreateUser::handle(Poco::Dynamic::Var params)
{
std::string email;
std::string first_name;
std::string last_name;
std::string password;
int emailType;
auto em = EmailManager::getInstance();
auto sm = SessionManager::getInstance();
// if is json object
if (params.type() == typeid(Poco::JSON::Object::Ptr)) {
Poco::JSON::Object::Ptr paramJsonObject = params.extract<Poco::JSON::Object::Ptr>();
/// Throws a RangeException if the value does not fit
/// into the result variable.
/// Throws a NotImplementedException if conversion is
/// not available for the given type.
/// Throws InvalidAccessException if Var is empty.
try {
paramJsonObject->get("email").convert(email);
paramJsonObject->get("first_name").convert(first_name);
paramJsonObject->get("last_name").convert(last_name);
paramJsonObject->get("emailType").convert(emailType);
if ((ServerConfig::g_AllowUnsecureFlags & ServerConfig::UNSECURE_PASSWORD_REQUESTS)) {
paramJsonObject->get("password").convert(password);
}
}
catch (Poco::Exception& ex) {
return stateError("json exception", ex.displayText());
}
}
else {
return stateError("parameter format unknown");
}
auto user = controller::User::create();
if (user->load(email) > 0) {
return customStateError("exist", "user already exist");
}
if (password.size()) {
ErrorList errors;
if (!sm->checkPwdValidation(password, &errors)) {
Poco::JSON::Object* result = new Poco::JSON::Object;
result->set("state", "error");
result->set("msg", errors.getLastError()->getString(false));
if (errors.errorCount()) {
result->set("details", errors.getLastError()->getString(false));
}
return result;
}
}
// create user
user = controller::User::create(email, first_name, last_name);
auto userModel = user->getModel();
Session* session = nullptr;
if (!userModel->insertIntoDB(true)) {
userModel->sendErrorsAsEmail();
return stateError("insert user failed");
}
if (password.size()) {
session = sm->getNewSession();
session->setUser(user);
session->generateKeys(true, true);
session->setClientIp(mClientIP);
// calculate encryption key, could need some time, will save encrypted privkey to db
UniLib::controller::TaskPtr create_authenticated_encrypten_key = new AuthenticatedEncryptionCreateKeyTask(user, password);
create_authenticated_encrypten_key->scheduleTask(create_authenticated_encrypten_key);
}
auto emailOptIn = controller::EmailVerificationCode::create(userModel->getID(), model::table::EMAIL_OPT_IN_REGISTER);
auto emailOptInModel = emailOptIn->getModel();
if (!emailOptInModel->insertIntoDB(false)) {
emailOptInModel->sendErrorsAsEmail();
return stateError("insert emailOptIn failed");
}
em->addEmail(new model::Email(emailOptIn, user, model::Email::convertTypeFromInt(emailType)));
return stateSuccess();
#include "JsonCreateUser.h"
#include "../model/email/Email.h"
#include "../controller/User.h"
#include "../controller/EmailVerificationCode.h"
#include "../SingletonManager/EmailManager.h"
#include "../SingletonManager/SessionManager.h"
#include "../tasks/AuthenticatedEncryptionCreateKeyTask.h"
Poco::JSON::Object* JsonCreateUser::handle(Poco::Dynamic::Var params)
{
std::string email;
std::string first_name;
std::string last_name;
std::string password;
int emailType;
auto em = EmailManager::getInstance();
auto sm = SessionManager::getInstance();
// if is json object
if (params.type() == typeid(Poco::JSON::Object::Ptr)) {
Poco::JSON::Object::Ptr paramJsonObject = params.extract<Poco::JSON::Object::Ptr>();
/// Throws a RangeException if the value does not fit
/// into the result variable.
/// Throws a NotImplementedException if conversion is
/// not available for the given type.
/// Throws InvalidAccessException if Var is empty.
try {
paramJsonObject->get("email").convert(email);
paramJsonObject->get("first_name").convert(first_name);
paramJsonObject->get("last_name").convert(last_name);
paramJsonObject->get("emailType").convert(emailType);
if ((ServerConfig::g_AllowUnsecureFlags & ServerConfig::UNSECURE_PASSWORD_REQUESTS)) {
paramJsonObject->get("password").convert(password);
}
}
catch (Poco::Exception& ex) {
return stateError("json exception", ex.displayText());
}
}
else {
return stateError("parameter format unknown");
}
auto user = controller::User::create();
if (user->load(email) > 0) {
return customStateError("exist", "user already exist");
}
if (password.size()) {
ErrorList errors;
if (!(ServerConfig::g_AllowUnsecureFlags & ServerConfig::UNSECURE_ALLOW_ALL_PASSWORDS) && !sm->checkPwdValidation(password, &errors)) {
Poco::JSON::Object* result = new Poco::JSON::Object;
result->set("state", "error");
result->set("msg", errors.getLastError()->getString(false));
if (errors.errorCount()) {
result->set("details", errors.getLastError()->getString(false));
}
return result;
}
}
// create user
user = controller::User::create(email, first_name, last_name);
auto userModel = user->getModel();
Session* session = nullptr;
if (!userModel->insertIntoDB(true)) {
userModel->sendErrorsAsEmail();
return stateError("insert user failed");
}
if (password.size()) {
session = sm->getNewSession();
session->setUser(user);
session->generateKeys(true, true);
session->setClientIp(mClientIP);
// calculate encryption key, could need some time, will save encrypted privkey to db
UniLib::controller::TaskPtr create_authenticated_encrypten_key = new AuthenticatedEncryptionCreateKeyTask(user, password);
create_authenticated_encrypten_key->scheduleTask(create_authenticated_encrypten_key);
}
auto emailOptIn = controller::EmailVerificationCode::create(userModel->getID(), model::table::EMAIL_OPT_IN_REGISTER);
auto emailOptInModel = emailOptIn->getModel();
if (!emailOptInModel->insertIntoDB(false)) {
emailOptInModel->sendErrorsAsEmail();
return stateError("insert emailOptIn failed");
}
em->addEmail(new model::Email(emailOptIn, user, model::Email::convertTypeFromInt(emailType)));
return stateSuccess();
}

4
src/cpp/JSONInterface/JsonRequestHandler.cpp
View File

@ -37,6 +37,10 @@ void JsonRequestHandler::handleRequest(Poco::Net::HTTPServerRequest& request, Po
if (parsedResult.size() != 0) {
json_result = handle(parsedResult);
}
else {
json_result = stateError("empty body");
}
}
else if(method == "GET") {
Poco::URI uri(request.getURI());

3
src/cpp/ServerConfig.cpp
View File

@ -246,6 +246,9 @@ namespace ServerConfig {
if (cfg.getInt("unsecure.allow_cors_all", 0) == 1) {
g_AllowUnsecureFlags = (AllowUnsecure)(g_AllowUnsecureFlags | UNSECURE_CORS_ALL);
}
if (cfg.getInt("unsecure.allow_all_passwords", 0) == 1) {
g_AllowUnsecureFlags = (AllowUnsecure)(g_AllowUnsecureFlags | UNSECURE_ALLOW_ALL_PASSWORDS);
}
return true;
}

3
src/cpp/ServerConfig.h
View File

@ -44,7 +44,8 @@ namespace ServerConfig {
NOT_UNSECURE = 0,
UNSECURE_PASSWORD_REQUESTS = 1,
UNSECURE_AUTO_SIGN_TRANSACTIONS = 2,
UNSECURE_CORS_ALL = 4
UNSECURE_CORS_ALL = 4,
UNSECURE_ALLOW_ALL_PASSWORDS = 8
};