From 941c9f1531351091b707803bf456cdc68b151eba Mon Sep 17 00:00:00 2001 From: Jakob Borg Date: Mon, 6 Nov 2017 14:22:10 +0000 Subject: [PATCH] cmd/syncthing: Accept pre-hashed password in config POST (fixes #4458) It must be a bcrypt hash. GitHub-Pull-Request: https://github.com/syncthing/syncthing/pull/4466 --- cmd/syncthing/gui.go | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/cmd/syncthing/gui.go b/cmd/syncthing/gui.go index 640f4778f..c486c5b85 100644 --- a/cmd/syncthing/gui.go +++ b/cmd/syncthing/gui.go @@ -16,6 +16,7 @@ import ( "os" "path/filepath" "reflect" + "regexp" "runtime" "runtime/pprof" "sort" @@ -43,6 +44,9 @@ import ( var ( startTime = time.Now() + + // matches a bcrypt hash and not too much else + bcryptExpr = regexp.MustCompile(`^\$2[aby]\$\d+\$.{50,}`) ) const ( @@ -790,7 +794,7 @@ func (s *apiService) postSystemConfig(w http.ResponseWriter, r *http.Request) { } if to.GUI.Password != s.cfg.GUI().Password { - if to.GUI.Password != "" { + if to.GUI.Password != "" && !bcryptExpr.MatchString(to.GUI.Password) { hash, err := bcrypt.GenerateFromPassword([]byte(to.GUI.Password), 0) if err != nil { l.Warnln("bcrypting password:", err)