Changeset 26425 for main/trunk/greenstone3/src

Timestamp:

2012-10-31T10:43:48+13:00 (11 years ago)

Author:

sjm84

Message:

Hopefully fixed the hashing algorithm so that it produces the same result on 32-bit and 64-bit machines

File:

• main/trunk/greenstone3/src/java/org/greenstone/gsdl3/service/Authentication.java (modified) (9 diffs)

main/trunk/greenstone3/src/java/org/greenstone/gsdl3/service/Authentication.java

@@ -3 +3 @@
 import java.io.File;
 import java.io.Serializable;
-import java.io.UnsupportedEncodingException;
 import java.math.BigInteger;
-import java.security.MessageDigest;
 import java.sql.SQLException;
 import java.util.ArrayList;
@@ -13 +11 @@
 import java.util.regex.Pattern;
 
-import java.util.Properties;
-import javax.mail.Message;
-import javax.mail.MessagingException;
-import javax.mail.Session;
-import javax.mail.Transport;
-import javax.mail.PasswordAuthentication;
-import javax.mail.internet.AddressException;
-import javax.mail.internet.InternetAddress;
-import javax.mail.internet.MimeMessage;
-
 import net.tanesha.recaptcha.ReCaptchaImpl;
 import net.tanesha.recaptcha.ReCaptchaResponse;
 
+import org.apache.commons.codec.digest.DigestUtils;
 import org.greenstone.gsdl3.util.DerbyWrapper;
 import org.greenstone.gsdl3.util.GSXML;
@@ -40 +29 @@
     protected static final int PASSWORD_MIN_LENGTH = 3;
     protected static final int PASSWORD_MAX_LENGTH = 64;
-    
+
     //Error codes
     protected static final int NO_ERROR = 0;
@@ -628 +617 @@
         else if (op.equals(PERFORM_RETRIEVE_PASSWORD))
         {
-            
+
         }
         else if (op.equals(PERFORM_CHANGE_PASSWORD))
@@ -636 +625 @@
             String oldPassword = (String) paramMap.get("oldPassword");
             String newPassword = (String) paramMap.get("newPassword");
-            if (user_name==null || oldPassword==null || newPassword==null)
+            if (user_name == null || oldPassword == null || newPassword == null)
             {
                 GSXML.addError(this.doc, result, _errorMessageMap.get("missing compulsory parameters: username, oldPassword, or newPassword"));
                 return result;
             }
-            
-            String prevPassword = retrieveDataForUser(user_name, "password");                       
+
+            String prevPassword = retrieveDataForUser(user_name, "password");
             if (!hashPassword(oldPassword).equals(prevPassword))
             {
@@ -649 +638 @@
                 return result;
             }
-            
+
             //Check the given password
             int error;
@@ -657 +646 @@
                 return result;
             }
-            
+
             String chpa_groups = retrieveDataForUser(user_name, "groups");
             String chpa_comment = "password_changed_by_user";
             String info = this._derbyWrapper.modifyUserInfo(user_name, hashPassword(newPassword), chpa_groups, null, chpa_comment, null);
-            if(info != "succeed"){//see DerbyWrapper.modifyUserInfo
+            if (info != "succeed")
+            {//see DerbyWrapper.modifyUserInfo
                 GSXML.addError(this.doc, result, _errorMessageMap.get(info));
                 return result;
@@ -792 +782 @@
     public static String hashPassword(String password)
     {
-        String hashedPassword = null;
-        try
-        {
-            MessageDigest digest = MessageDigest.getInstance("SHA-1");
-            digest.reset();
-            hashedPassword = new String(digest.digest(password.getBytes("US-ASCII"))); // toHex after using ASCII charset will result in acceptable length of hex string
-            hashedPassword = toHex(hashedPassword); // this conversion is required to avoid the strange error of login failure on some legal password strings
-        }
-        catch (Exception ex)
-        {
-            ex.printStackTrace();
-        }
-        return hashedPassword;
+        return DigestUtils.sha1Hex(password);
     }
 
@@ -1091 +1069 @@
     }
 
-    // main() method - calls hashPassword() on any String argument, printing this to stdout
-    // This main() is invoked by gliserver.pl perl code to encrypt passwords identically to Java code.
-    public static void main(String[] args) {
-    if(args.length < 1) {
-        System.err.println("Usage: Authentication <string to encrypt>");
-        System.exit(-1);
-    }
-    // just hash the first argument
-    String hash = Authentication.hashPassword(args[0]);
-    System.out.println(hash);
-    }
+    // main() method - calls hashPassword() on any String argument, printing this to stdout
+    // This main() is invoked by gliserver.pl perl code to encrypt passwords identically to Java code.
+    public static void main(String[] args)
+    {
+        if (args.length < 1)
+        {
+            System.err.println("Usage: Authentication <string to encrypt>");
+            System.exit(-1);
+        }
+        // just hash the first argument
+        String hash = Authentication.hashPassword(args[0]);
+        System.out.println(hash);
+    }
 }