Mirrors/sftpgo
1
0
Fork 0
mirror of https://github.com/drakkan/sftpgo.git synced 2025-12-06 14:20:55 +03:00
Code Issues Packages Projects Releases Wiki Activity

enforce group-level password strength for users and shares

Browse Source 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
This commit is contained in:
Nicola Murino
2025-10-26 09:44:32 +01:00
parent accb9703d0
commit 5ce9688780
3 changed files with 68 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
internal/dataprovider/dataprovider.go
View File

@@ -2144,9 +2144,6 @@ func UpdateUserPassword(username, plainPwd, executor, ipAddress, role string) er
return err
}
userCopy := user.getACopy()
if err := userCopy.LoadAndApplyGroupSettings(); err != nil {
return err
}
userCopy.Password = plainPwd
if err := createUserPasswordHash(&userCopy); err != nil {
return err
@@ -3336,6 +3333,19 @@ func hashPlainPassword(plainPwd string) (string, error) {
func createUserPasswordHash(user *User) error {
if user.Password != "" && !user.IsPasswordHashed() {
for _, g := range user.Groups {
if g.Type == sdk.GroupTypePrimary {
group, err := GroupExists(g.Name)
if err != nil {
return errors.New("unable to load group password policies")
}
if minEntropy := group.UserSettings.Filters.PasswordStrength; minEntropy > 0 {
if err := passwordvalidator.Validate(user.Password, float64(minEntropy)); err != nil {
return util.NewI18nError(util.NewValidationError(err.Error()), util.I18nErrorPasswordComplexity)
}
}
}
}
if minEntropy := user.getMinPasswordEntropy(); minEntropy > 0 {
if err := passwordvalidator.Validate(user.Password, minEntropy); err != nil {
return util.NewI18nError(util.NewValidationError(err.Error()), util.I18nErrorPasswordComplexity)

2
internal/dataprovider/share.go
View File

@@ -146,7 +146,7 @@ func (s *Share) HasRedactedPassword() bool {
func (s *Share) hashPassword() error {
if s.Password != "" && !util.IsStringPrefixInSlice(s.Password, internalHashPwdPrefixes) {
user, err := UserExists(s.Username, "")
user, err := GetUserWithGroupSettings(s.Username, "")
if err != nil {
return util.NewGenericError(fmt.Sprintf("unable to validate user: %v", err))
}