jaculabilis/danbooru
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Major revamp of security. Passwords are first SHA1 hashed and then

Browse Source 
that hash is bcrypted.  Bcrypted hashes are stored in a new column on
users.  This separate column is only to allow for rollbacks,
eventually the old SHA1 hash column will be removed.  Sensitive cookie
details are now encrypted to prevent user tampering and more stringent
checks on secret_token and session_secret_key are enforced.
This commit is contained in:
albert
2013-03-04 22:55:41 -05:00
parent bae5835cff
commit f52181db94
13 changed files with 108 additions and 68 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
config/initializers/secret_token.rb
View File

@@ -1,13 +1,9 @@
# Be sure to restart your server when you modify this file.
require File.expand_path('../../state_checker', __FILE__)
# Your secret key for verifying the integrity of signed cookies.
# If you change this key, all old signed cookies will become invalid!
# Make sure the secret is at least 30 characters and all random,
# no regular words or you'll be exposed to dictionary attacks.
if File.exists?(File.expand_path("~/.danbooru/secret_token"))
Danbooru::Application.config.secret_token = File.read(File.expand_path("~/.danbooru/secret_token"))
else
Danbooru::Application.config.secret_token = SecureRandom.hex(64)
end
StateChecker.new.check!
Danbooru::Application.config.action_dispatch.session = {
:key => '_danbooru2_session',
:secret => File.read(File.expand_path("~/.danbooru/session_secret_key"))
}
Danbooru::Application.config.secret_token = File.read(File.expand_path("~/.danbooru/secret_token"))