* Replace bcrypt challenge auth with direct password comparison
Closes#2428
Highlights:
* Replaced the bcrypt challenge authentication flow with direct password comparison against the bcrypt hash stored in the user configuration.
* Removed the `bcrypt.js` dependency, so authentication no longer depends on JavaScript.
* Removed the nonce and challenge mechanism and the `nonce` endpoint from the `javascript` controller.
* Removed the JavaScript and HTML code used for the previous authentication flow.
* Removed the `<noscript>` blocks that were only needed for the previous authentication flow.
* Updated `FreshRSS_FormAuth::checkCredentials()` to accept the username, stored bcrypt hash, and plain-text password directly.
* The stored password hash must still use the expected bcrypt format.
* Empty or whitespace-only passwords are rejected even if the hash would otherwise match.
* The bcrypt 72-byte limit is enforced during normal authentication.
* Existing bcrypt passwords are handled correctly when the 72-byte limit cuts through a UTF-8 character.
* Password input is no longer trimmed before authentication or password changes. Leading and trailing whitespace is therefore kept as part of the password.
* Added `FreshRSS_FormAuth::passwordRequirementsMet()` to replace `FreshRSS_password_Util::check()`.
* New passwords must be between 7 and 72 bytes by default.
* The minimum length check can be disabled where needed.
* Password requirements are now checked server-side for all password creation and update paths.
* Added client-side byte-length validation for password fields using `TextEncoder` and `data-max-bytes`.
* This gives better feedback for UTF-8 passwords.
* Server-side validation remains authoritative.
* Updated password handling in authentication, re-authentication, self-deletion, user creation, and user update paths so passwords are not trimmed automatically.
* Added `FormAuthTest` to cover:
* password length limits in bytes
* UTF-8 passwords around the 72-byte limit
* bcrypt truncation behavior during authentication
* malformed and non-bcrypt hashes
* empty passwords
* authentication failures and log messages
* Removed `bcrypt.js` from the documented dependencies and updated the authentication documentation.
* Updated the installation and authentication views and JavaScript to match the new password handling.
This simplifies the authentication flow, removes the client-side bcrypt challenge, makes password validation consistent between the client and server, and adds more test coverage while keeping compatibility with existing bcrypt password hashes.
Because the password is now sent directly to the server instead of being processed by `bcrypt.js`, deployments should use HTTPS. Documentation for HTTPS setup can be handled separately.
* Add test case with password truncated down to 71 characters
* Compare log messages too during form auth tests
* Mark the `getLastLog()` method as impure
* Fix: Check password reqs against new password instead of current
* Fix: Add custom JS validator for UTF-8, handle cut-off UTF-8 during login
* Fix: Enforce password requirements everywhere server-side
* Add TODO for updateUser in CLI
* make readme
* Fix extra.js in install.php
* Don't report validity yet if the password is too short or not filled out
* Simplify checking of whether to report validity
* Fix: Do not trim password from user's input
* Also `trim: false` in some userController paths
* Use the proper argument order for PHPUnit's `assertSame()`
* Remove `maxlength` in favor of `data-max-bytes`
But add `pattern` again for some nojs support
* make readme
* composer run-script translations
* Update i18n string for web form admin setting
* i18n: fr
* Minor whitespace
---------
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
1. `include`, `include_once`, `require` and `require_once` are expressions not functions, parentheses are not necessary.
2. to move up the directory tree, it's better to use the `dirname` function instead of relying on `/..`.
* Adds logic for validation
* Adds validation to do-install
* Adds help to do-install
* Adds validation & help to reconfigure
* Adds validation to check.translation
* Adds validation to manipulate.translation
* Small fixes to help texts
* Refactors language option validation
* Adds default options to validation
* Fixes validation with regex
* Refactors readAs functions
* Updates to new regex validation format
* Fixes typing around default values
* Adds file extension validation
* Restandardises validation & parsing typing around array of strings
* Adds NotOneOf validation
* Adds ArrayOfString read as
* Refactors existing validation
* Adds validation throughout cli
* Removes unused file
* Adds new CL parser with goal of wrapping CLI behaviour
* Hides parsing and validation
* Rewites CL parser to make better use of classes
* Rolls out new parser across CL
* Fixes error during unknown option check
* Fixes misnamed property calls
* Seperates validations into more appropriate locations
* Adds common boolean forms to validation
* Moves CommandLineParser and Option classes into their own files
* Fixes error when validating Int type
* Rewrites appendTypedValues -> appendTypedValidValues now filters invalid values from output
* Renames -> for clarity
* Adds some docs clarifying option defaults and value taking behaviour
* Refactors getUsageMessage for readability
* Minor formatting changes
* Adds tests for CommandLineParser
* Adds more tests
* Adds minor fixs
* Reconfigure now correctly updates config
* More fixes to reconfigure
* Fixes required files for CommandLineParserTest
* Use .php extension for PHP file
* PHPStan ignore instead of wrong typing
* Refactors to support php 7.4
* Moves away from dynamic properties by adding 'Definintions' to all commands
* Renames target to definition for clarity
* Stops null from being returned as a valid value in a certain edge case
* Adds PHPStan ignore instead of incorrect typing
* Refactors tests to take account of new typing solution
* Marks file as executable
* Draft CLI rework
* Finish rewrite as object-oriented
* Fix PHPStan ignore and make more strongly typed
* Rename class Option to CliOption
* Light renaming + anonymous classes
---------
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
* Little's optimisations and booleans in conditions
* Apply strict type
* Apply strict type
* Apply strict type
* Fix multiple bugs with PHP 8.2 and 8.3
* Many declares missing, more errors fixed
* Apply strict type
* Another approach
* Stronger typing for Minz_Session
* Fix case of SQLite
---------
Co-authored-by: Luc <sanchezluc+freshrss@gmail.com>
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
* Extract hashPassword method from userController
* Extract and refactor fever key-related methods
* Move update of API password to dedicated action
* Simplify the controller by refactoring feverUtil
* Add locales
* Add an email field to the profile page
I reuse the `mail_login` from the configuration. I'm not sure if it's
useful today (I would say it was used when Persona login was available).
A good improvement would be to rename `mail_login` into `email` so it
would be more intuitive to use.
* Add boolean to the conf to force email validation
This commit only adds a configuration item.
* Add email during registration if email must be validated
* Set email token to validate when email changes
* Block access to FreshRSS if email is not validated
* Send email when address is changed
* Allow to resend the validation email
* Allow the user to change its email while blocked
* Document the email validation feature
* fixup! Allow the user to change its email while blocked
* tec: Autoload PHPMailer lib
* Validate email address format
* Add feedback on validation email resend action
* Allow to logout when user is blocked
* fix: Change default email "from"
* Reorganize i18n keys
* Complete all the locales with default english
* Hide sidebar (profile page) if email is not validated
* Check email requirements on registration
* Allow admin to specify email when creating users
* Don't check email format if value is empty
* Remove trailing comma in userController
Co-Authored-By: Alexandre Alapetite <alexandre@alapetite.fr>
* Set PHPMailer validator to html5 before sending email
* fixup! Remove trailing comma in userController
