|
|
@@ -1,5 +1,6 @@
|
|
|
import hashlib
|
|
|
import hmac
|
|
|
+import binascii
|
|
|
import os
|
|
|
|
|
|
import tornado.gen
|
|
|
@@ -8,13 +9,13 @@ import momoko
|
|
|
|
|
|
import config
|
|
|
|
|
|
-def hash_pw(password, key=None):
|
|
|
- if key is None:
|
|
|
- key = os.urandom(16)
|
|
|
- digest = hmac.new(key, password, hashlib.sha256)
|
|
|
- key = key.encode("hex")
|
|
|
- hashed = digest.hexdigest()
|
|
|
- return key, hashed
|
|
|
+def hash_pw(password, salt=None):
|
|
|
+ if salt is None:
|
|
|
+ salt = os.urandom(16)
|
|
|
+ h = hmac.new(salt, password.encode('utf-8'), hashlib.sha256)
|
|
|
+ hashed = h.hexdigest()
|
|
|
+ salt_hex = binascii.hexlify(salt).decode()
|
|
|
+ return hashed, salt_hex
|
|
|
|
|
|
class MomokoDB:
|
|
|
db = momoko.Pool(dsn='dbname=%s user=%s' % (config.db.database, config.db.user), size=2)
|
|
|
@@ -26,7 +27,7 @@ class MomokoDB:
|
|
|
|
|
|
@tornado.gen.coroutine
|
|
|
def create_user(self, username, password):
|
|
|
- salt, hashed_password = hash_pw(password)
|
|
|
+ hashed_password, salt = hash_pw(password)
|
|
|
query = 'INSERT INTO users (username, password, salt) VALUES (%s, %s, %s);'
|
|
|
yield self.execute(query, username, hashed_password, salt)
|
|
|
|
|
|
@@ -41,6 +42,9 @@ class MomokoDB:
|
|
|
user = yield self.get_user(username)
|
|
|
if not user:
|
|
|
return
|
|
|
- _, hashed = hash_pw(password, user['salt'].decode("hex"))
|
|
|
+ salt = binascii.unhexlify(bytes(user['salt'], 'ascii'))
|
|
|
+ hashed, _ = hash_pw(password, salt)
|
|
|
+ print(hashed)
|
|
|
+ print(user['password'])
|
|
|
if hashed == user['password']:
|
|
|
return user
|