aio-libs / aio-libs/aiosmtpd

Example authenticated replayer is not working; Solved

未關閉
#390 0 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視
主要語言
Python
星號
373
分支
105
平均合併
4 分鐘
30 天內合併 PR
2

描述

Dear aiosmtpd people!
Thank you for your work!

The "authenticated replayer" example has two bugs:

* The username and password have to be decoded to utf-8 since they may be bytes (dependent of the client).
* Argon2 hashes cannot simply be compared, they have to be verified.

Here the fixed code.

```
class Authenticator:
def __init__(self, auth_database):
self.auth_db = Path(auth_database)
self.ph = PasswordHasher()

def __call__(self, server, session, envelope, mechanism, auth_data):
fail_nothandled = AuthResult(success=False, handled=False)
if mechanism not in ("LOGIN", "PLAIN"):
return fail_nothandled
if not isinstance(auth_data, LoginPassword):
return fail_nothandled
username = auth_data.login.decode()
password = auth_data.password.decode()
conn = sqlite3.connect(self.auth_db)
curs = conn.execute(
"SELECT hashpass FROM userauth WHERE username=?", (username,)
)
hash_db = curs.fetchone()
conn.close()
if not hash_db:
return fail_nothandled
if not self.ph.verify(hash_db[0], password):
return fail_nothandled
return AuthResult(success=True)
```

Cheers,
Volker

貢獻指南

開啟貢獻指南

評估

這個 Issue 還沒有評估資料。

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。