* Replace bcrypt challenge auth with direct password comparison
Closes#2428
Highlights:
* Replaced the bcrypt challenge authentication flow with direct password comparison against the bcrypt hash stored in the user configuration.
* Removed the `bcrypt.js` dependency, so authentication no longer depends on JavaScript.
* Removed the nonce and challenge mechanism and the `nonce` endpoint from the `javascript` controller.
* Removed the JavaScript and HTML code used for the previous authentication flow.
* Removed the `<noscript>` blocks that were only needed for the previous authentication flow.
* Updated `FreshRSS_FormAuth::checkCredentials()` to accept the username, stored bcrypt hash, and plain-text password directly.
* The stored password hash must still use the expected bcrypt format.
* Empty or whitespace-only passwords are rejected even if the hash would otherwise match.
* The bcrypt 72-byte limit is enforced during normal authentication.
* Existing bcrypt passwords are handled correctly when the 72-byte limit cuts through a UTF-8 character.
* Password input is no longer trimmed before authentication or password changes. Leading and trailing whitespace is therefore kept as part of the password.
* Added `FreshRSS_FormAuth::passwordRequirementsMet()` to replace `FreshRSS_password_Util::check()`.
* New passwords must be between 7 and 72 bytes by default.
* The minimum length check can be disabled where needed.
* Password requirements are now checked server-side for all password creation and update paths.
* Added client-side byte-length validation for password fields using `TextEncoder` and `data-max-bytes`.
* This gives better feedback for UTF-8 passwords.
* Server-side validation remains authoritative.
* Updated password handling in authentication, re-authentication, self-deletion, user creation, and user update paths so passwords are not trimmed automatically.
* Added `FormAuthTest` to cover:
* password length limits in bytes
* UTF-8 passwords around the 72-byte limit
* bcrypt truncation behavior during authentication
* malformed and non-bcrypt hashes
* empty passwords
* authentication failures and log messages
* Removed `bcrypt.js` from the documented dependencies and updated the authentication documentation.
* Updated the installation and authentication views and JavaScript to match the new password handling.
This simplifies the authentication flow, removes the client-side bcrypt challenge, makes password validation consistent between the client and server, and adds more test coverage while keeping compatibility with existing bcrypt password hashes.
Because the password is now sent directly to the server instead of being processed by `bcrypt.js`, deployments should use HTTPS. Documentation for HTTPS setup can be handled separately.
* Add test case with password truncated down to 71 characters
* Compare log messages too during form auth tests
* Mark the `getLastLog()` method as impure
* Fix: Check password reqs against new password instead of current
* Fix: Add custom JS validator for UTF-8, handle cut-off UTF-8 during login
* Fix: Enforce password requirements everywhere server-side
* Add TODO for updateUser in CLI
* make readme
* Fix extra.js in install.php
* Don't report validity yet if the password is too short or not filled out
* Simplify checking of whether to report validity
* Fix: Do not trim password from user's input
* Also `trim: false` in some userController paths
* Use the proper argument order for PHPUnit's `assertSame()`
* Remove `maxlength` in favor of `data-max-bytes`
But add `pattern` again for some nojs support
* make readme
* composer run-script translations
* Update i18n string for web form admin setting
* i18n: fr
* Minor whitespace
---------
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
* Housekeeping lib_rss.php
`lib_rss.php` had become much too large, especially after https://github.com/FreshRSS/FreshRSS/pull/7924
Moved most functions to other places.
Mostly no change of code otherwise (see comments).
* Extension: composer run-script phpstan-third-party
1. `include`, `include_once`, `require` and `require_once` are expressions not functions, parentheses are not necessary.
2. to move up the directory tree, it's better to use the `dirname` function instead of relying on `/..`.
* Fix CLI install with prefix
It was not possible to pass a blank prefix
* Fix regression EXIT_CODE_ALREADY_EXISTS
The dedicated exit code was not sent anymore when a user already exists
* Adds logic for validation
* Adds validation to do-install
* Adds help to do-install
* Adds validation & help to reconfigure
* Adds validation to check.translation
* Adds validation to manipulate.translation
* Small fixes to help texts
* Refactors language option validation
* Adds default options to validation
* Fixes validation with regex
* Refactors readAs functions
* Updates to new regex validation format
* Fixes typing around default values
* Adds file extension validation
* Restandardises validation & parsing typing around array of strings
* Adds NotOneOf validation
* Adds ArrayOfString read as
* Refactors existing validation
* Adds validation throughout cli
* Removes unused file
* Adds new CL parser with goal of wrapping CLI behaviour
* Hides parsing and validation
* Rewites CL parser to make better use of classes
* Rolls out new parser across CL
* Fixes error during unknown option check
* Fixes misnamed property calls
* Seperates validations into more appropriate locations
* Adds common boolean forms to validation
* Moves CommandLineParser and Option classes into their own files
* Fixes error when validating Int type
* Rewrites appendTypedValues -> appendTypedValidValues now filters invalid values from output
* Renames -> for clarity
* Adds some docs clarifying option defaults and value taking behaviour
* Refactors getUsageMessage for readability
* Minor formatting changes
* Adds tests for CommandLineParser
* Adds more tests
* Adds minor fixs
* Reconfigure now correctly updates config
* More fixes to reconfigure
* Fixes required files for CommandLineParserTest
* Use .php extension for PHP file
* PHPStan ignore instead of wrong typing
* Refactors to support php 7.4
* Moves away from dynamic properties by adding 'Definintions' to all commands
* Renames target to definition for clarity
* Stops null from being returned as a valid value in a certain edge case
* Adds PHPStan ignore instead of incorrect typing
* Refactors tests to take account of new typing solution
* Marks file as executable
* Draft CLI rework
* Finish rewrite as object-oriented
* Fix PHPStan ignore and make more strongly typed
* Rename class Option to CliOption
* Light renaming + anonymous classes
---------
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
* Pass PHPStan level 8
And prepare for PHPStan level 9 https://phpstan.org/user-guide/rule-levels
* Revert wrong replace in comment
* Fix PHPStan level 8
* Update PHPStan and other dev dependencies
* Remove obsolete comment
* noVariableVariables and towards bleedingEdge
https://github.com/phpstan/phpstan-strict-ruleshttps://phpstan.org/blog/what-is-bleeding-edge
* More bleedingEdge
* A bit more PHPStan level 9
* More PHPStan level 9
* Prepare for booleansInConditions
Ignore int and null
* Revert wrong line
* More fixes
* Fix keep_max_n_unread
* Stricter attribute functions
* Stricter callHooks and more PHPStan level 9
* More typing
* A tiny more
* Little's optimisations and booleans in conditions
* Apply strict type
* Apply strict type
* Apply strict type
* Fix multiple bugs with PHP 8.2 and 8.3
* Many declares missing, more errors fixed
* Apply strict type
* Another approach
* Stronger typing for Minz_Session
* Fix case of SQLite
---------
Co-authored-by: Luc <sanchezluc+freshrss@gmail.com>
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
* fix many "Only booleans are allowed in an if condition"
* Update cli/create-user.php
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
* Update cli/i18n/I18nUsageValidator.php
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
* Fix several regressions and other minor things
* Fix another regression
* Update lib/http-conditional.php
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
---------
Co-authored-by: Luc <sanchezluc+freshrss@gmail.com>
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
* Possiblity to autoinstall in Docker Compose
#fix https://github.com/FreshRSS/FreshRSS/issues/3349
It is simply calling our existing CLI: do-install.php and
create-user.php
https://github.com/FreshRSS/FreshRSS/tree/master/cli
FreshRSS will typically be ready a few seconds before the database, so
introduce a tolerance when the database is not available / up (yet) by
trying a few times to connect. Also useful to avoid service interruption
when DB service is restarted.
Example:
```yml
freshrss-app:
image: freshrss/freshrss
container_name:
freshrss-app
hostname: freshrss-app
restart: unless-stopped
ports:
- "8080:80"
depends_on:
- freshrss-db
volumes:
- data:/var/www/FreshRSS/data
-
extensions:/var/www/FreshRSS/extensions
environment:
CRON_MIN:
'*/20'
FRESHRSS_ENV: development
FRESHRSS_INSTALL: |-
--api_enabled
--base_url https://rss.example.net
--db-base freshrss
--db-host freshrss-db
--db-password
freshrss
--db-type pgsql
--db-user freshrss
--default_user admin
--language en
FRESHRSS_USER: |-
--api_password freshrss
--email user@example.net
--language en
--password freshrss
--user admin
TZ:
Europe/Paris
```
* Minor type f in find
* shellcheck
* Extract hashPassword method from userController
* Extract and refactor fever key-related methods
* Move update of API password to dedicated action
* Simplify the controller by refactoring feverUtil
* Add locales
* Add an email field to the profile page
I reuse the `mail_login` from the configuration. I'm not sure if it's
useful today (I would say it was used when Persona login was available).
A good improvement would be to rename `mail_login` into `email` so it
would be more intuitive to use.
* Add boolean to the conf to force email validation
This commit only adds a configuration item.
* Add email during registration if email must be validated
* Set email token to validate when email changes
* Block access to FreshRSS if email is not validated
* Send email when address is changed
* Allow to resend the validation email
* Allow the user to change its email while blocked
* Document the email validation feature
* fixup! Allow the user to change its email while blocked
* tec: Autoload PHPMailer lib
* Validate email address format
* Add feedback on validation email resend action
* Allow to logout when user is blocked
* fix: Change default email "from"
* Reorganize i18n keys
* Complete all the locales with default english
* Hide sidebar (profile page) if email is not validated
* Check email requirements on registration
* Allow admin to specify email when creating users
* Don't check email format if value is empty
* Remove trailing comma in userController
Co-Authored-By: Alexandre Alapetite <alexandre@alapetite.fr>
* Set PHPMailer validator to html5 before sending email
* fixup! Remove trailing comma in userController
* [ci] Add Travis
* Exclude some libs
* Semi-auto whitespace fixes
* line length in SQLite
* Exclude tests from line length
* Feed.php line length
* Feed.php: get rid of unnecessary concat
* Feed.php: line length
* bootstrap.php: no newline at end of file
* Allow concatenating across multiple lines
* Add Travis badge
* do-install line length
* update-or-create-user line length
* cli/create-user line length
* tests/app/Models/SearchTest.php fix indentation
* tests/app/Models/UserQueryTest.php fix indentation
* tests/app/Models/CategoryTest.php fix indentation
* [fix] PHP 5.3 on precise
* cli/do-install no spaces
* cli/list-users line length
* cli/reconfigure line length
* empty catch statements
* api/index line length nonsense
* spaces before semicolon
* app/Models/EntryDAO bunch of indentation
* extra blank lines
* spaces before comma in function call
* testing tabwidth
* increase to 10
* comment out tabwidth line
* try older phpcs version 3.0.0RC4
* line length exception for app/install.php
* proper spaces
* stray spaces in i18n
* Minz/ModelPdo line length
* Minz whitespace
* greader line length
* greader elseif placement
* app/Models/Feed.php spacing in function argument
* ignore php 5.3
* app/Models/ConfigurationSetter.php stray whitespace
* EntryDAOSQLite line length
* I vote for higher max line length =P
* ignore SQL
* remove classname complaint
* line length/more legible SQL
* ignore line length nonsense
* greader line length
* feedController issues
* uppercase TRUE, FALSE, NULL
* revert
* importExportController lowercase null
* Share.php default value not necessary because ! is_array () a few lines down
* CategoryDAO constants should be UPPERCASE
* EntryDAO reduce line length
* contentious autofix
* Allow failures on all versions of PHP except 7.1 because reasons
