gitea

4,800 Commits 19 Branches 243 Tags

3 Commits

Author	SHA1	Message	Date
Denis DenisovandThomas Boerger	380e32e129	Fix random string generator (#384 ) * Remove unused custom-alphabet feature of random string generator Fix random string generator Random string generator should return error if it fails to read random data via crypto/rand * Fixes variable (un)initialization mixed assign Update test GetRandomString	2016-12-20 13:32:02 +01:00
Denis DenisovandLunny Xiao	f0a989c1d0	Correction LDAP validation (#342 ) * Correction LDAP username validation As https://msdn.microsoft.com/en-us/library/aa366101(v=vs.85).aspx describe spaces should not be in start or at the end of username but they can be inside the username. So please check my solution for it. * Check for zero length passwords in LDAP module. According to https://tools.ietf.org/search/rfc4513#section-5.1.2 LDAP client should always check before bind whether a password is an empty value. There are at least one LDAP implementation which does not return error if you try to bind with DN set and empty password - AD. * Clearing the login/email spaces at the [start/end]	2016-12-12 08:46:51 +08:00
Denis DenisovandLunny Xiao	c8f300b2cd	Safe compare password (timing attack) (#338 )	2016-12-03 13:49:17 +08:00

Author

SHA1

Message

Date

Denis DenisovandThomas Boerger

380e32e129

Fix random string generator (#384 )

* Remove unused custom-alphabet feature of random string generator

Fix random string generator

Random string generator should return error if it fails to read random data via crypto/rand

* Fixes variable (un)initialization mixed assign
Update test GetRandomString

2016-12-20 13:32:02 +01:00

Denis DenisovandLunny Xiao

f0a989c1d0

Correction LDAP validation (#342 )

* Correction LDAP username validation

As https://msdn.microsoft.com/en-us/library/aa366101(v=vs.85).aspx describe spaces should not be in start or at the end of username but they can be inside the username. So please check my solution for it.

* Check for zero length passwords in LDAP module.

According to https://tools.ietf.org/search/rfc4513#section-5.1.2 LDAP client should always check before bind whether a password is an empty value. There are at least one LDAP implementation which does not return error if you try to bind with DN set and empty password - AD.

* Clearing the login/email spaces at the [start/end]

2016-12-12 08:46:51 +08:00

Denis DenisovandLunny Xiao

c8f300b2cd

Safe compare password (timing attack) (#338 )

2016-12-03 13:49:17 +08:00