Homec4science

Allow users to recover from a missing password hasher

Authored by epriestley <git@epriestley.com> on Aug 21 2014, 20:30.

Description

Allow users to recover from a missing password hasher

Summary:
Fixes T5934. If you hash a password with, e.g., bcrypt, and then lose the bcrypt hasher for some reason, we currently fatal when trying to figure out if we can upgrade.

Instead, detect that the current hasher implementation has vanished and let the user reset their password (for account passwords) or choose a new one (for VCS passwords)>

Test Plan:
Account password:

  • Artifically disabled bcrypt hasher.
  • Viewed password panel, saw warnings about missing hasher.
  • Used password reset workflow to change password, saw iterated MD5 hashed password get set.
  • Enabled bcrypt hasher again.
  • Saw upgrade warning.
  • Upgraded password to bcrypt.

VCS password:

  • Artificially disabled bcrypt hasher.
  • Viewed password panel, saw warnings about missing hasher.
  • Reset password.
  • Saw iterated md5 password.
  • Reenabled bcrypt.
  • Upgraded to bcrypt.

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: epriestley

Maniphest Tasks: T5934

Differential Revision: https://secure.phabricator.com/D10325

Details

Committed
epriestley <git@epriestley.com>Aug 21 2014, 20:30
Pushed
aubortJan 31 2017, 17:16
Parents
rPH241cfc2e8312: Don't leave temporary files around when trying to use credentials with…
Branches
Unknown
Tags
Unknown

Event Timeline

epriestley <git@epriestley.com> committed rPHd122d9ec86a8: Allow users to recover from a missing password hasher (authored by epriestley <git@epriestley.com>).Aug 21 2014, 20:30