From f8122cd2cad64c27d9d1d3aed34f839b39bdfec0 Mon Sep 17 00:00:00 2001 From: sirux88 Date: Fri, 13 Jan 2023 12:10:33 +0100 Subject: [PATCH 1/2] include key into user.set_password --- src/api/core/accounts.rs | 13 ++++++------- src/api/core/emergency_access.rs | 5 ++--- src/db/models/user.rs | 5 +++-- 3 files changed, 11 insertions(+), 12 deletions(-) diff --git a/src/api/core/accounts.rs b/src/api/core/accounts.rs index 1f932f69..7fa3f222 100644 --- a/src/api/core/accounts.rs +++ b/src/api/core/accounts.rs @@ -160,8 +160,7 @@ pub async fn _register(data: JsonUpcase, mut conn: DbConn) -> Json user.client_kdf_type = client_kdf_type; } - user.set_password(&data.MasterPasswordHash, None); - user.akey = data.Key; + user.set_password(&data.MasterPasswordHash, &data.Key, None); user.password_hint = password_hint; // Add extra fields if present @@ -291,9 +290,10 @@ async fn post_password( user.set_password( &data.NewMasterPasswordHash, + &data.Key, Some(vec![String::from("post_rotatekey"), String::from("get_contacts"), String::from("get_public_keys")]), ); - user.akey = data.Key; + let save_result = user.save(&mut conn).await; nt.send_user_update(UpdateType::LogOut, &user).await; @@ -323,8 +323,7 @@ async fn post_kdf(data: JsonUpcase, headers: Headers, mut conn: D user.client_kdf_iter = data.KdfIterations; user.client_kdf_type = data.Kdf; - user.set_password(&data.NewMasterPasswordHash, None); - user.akey = data.Key; + user.set_password(&data.NewMasterPasswordHash, &data.Key, None); let save_result = user.save(&mut conn).await; nt.send_user_update(UpdateType::LogOut, &user).await; @@ -533,8 +532,8 @@ async fn post_email( user.email_new = None; user.email_new_token = None; - user.set_password(&data.NewMasterPasswordHash, None); - user.akey = data.Key; + user.set_password(&data.NewMasterPasswordHash, &data.Key, None); + let save_result = user.save(&mut conn).await; nt.send_user_update(UpdateType::LogOut, &user).await; diff --git a/src/api/core/emergency_access.rs b/src/api/core/emergency_access.rs index 7a683ea4..e49953ac 100644 --- a/src/api/core/emergency_access.rs +++ b/src/api/core/emergency_access.rs @@ -645,7 +645,7 @@ async fn password_emergency_access( let data: EmergencyAccessPasswordData = data.into_inner().data; let new_master_password_hash = &data.NewMasterPasswordHash; - let key = data.Key; + let key = &data.Key; let requesting_user = headers.user; let emergency_access = match EmergencyAccess::find_by_uuid(&emer_id, &mut conn).await { @@ -663,8 +663,7 @@ async fn password_emergency_access( }; // change grantor_user password - grantor_user.set_password(new_master_password_hash, None); - grantor_user.akey = key; + grantor_user.set_password(new_master_password_hash, key, None); grantor_user.save(&mut conn).await?; // Disable TwoFactor providers since they will otherwise block logins diff --git a/src/db/models/user.rs b/src/db/models/user.rs index b59f10b8..3215262c 100644 --- a/src/db/models/user.rs +++ b/src/db/models/user.rs @@ -143,17 +143,18 @@ impl User { /// # Arguments /// /// * `password` - A str which contains a hashed version of the users master password. + /// * `new_key` - A String which contains the new aKey value of the users master password. /// * `allow_next_route` - A Option> with the function names of the next allowed (rocket) routes. /// These routes are able to use the previous stamp id for the next 2 minutes. /// After these 2 minutes this stamp will expire. /// - pub fn set_password(&mut self, password: &str, allow_next_route: Option>) { + pub fn set_password(&mut self, password: &str, new_key: &str, allow_next_route: Option>) { self.password_hash = crypto::hash_password(password.as_bytes(), &self.salt, self.password_iterations as u32); if let Some(route) = allow_next_route { self.set_stamp_exception(route); } - + self.akey = String::from(new_key); self.reset_security_stamp() } From 623d84aeb5b150f38f9e9443a965b1a34841602f Mon Sep 17 00:00:00 2001 From: sirux88 Date: Sat, 14 Jan 2023 10:16:03 +0100 Subject: [PATCH 2/2] include key into user.set_password --- src/api/core/accounts.rs | 13 ++++++------- src/api/core/emergency_access.rs | 5 ++--- src/db/models/user.rs | 5 +++-- 3 files changed, 11 insertions(+), 12 deletions(-) diff --git a/src/api/core/accounts.rs b/src/api/core/accounts.rs index 758d9028..2efca351 100644 --- a/src/api/core/accounts.rs +++ b/src/api/core/accounts.rs @@ -161,8 +161,7 @@ pub async fn _register(data: JsonUpcase, mut conn: DbConn) -> Json user.client_kdf_type = client_kdf_type; } - user.set_password(&data.MasterPasswordHash, None); - user.akey = data.Key; + user.set_password(&data.MasterPasswordHash, &data.Key, None); user.password_hint = password_hint; // Add extra fields if present @@ -318,9 +317,10 @@ async fn post_password( user.set_password( &data.NewMasterPasswordHash, + &data.Key, Some(vec![String::from("post_rotatekey"), String::from("get_contacts"), String::from("get_public_keys")]), ); - user.akey = data.Key; + let save_result = user.save(&mut conn).await; nt.send_user_update(UpdateType::LogOut, &user).await; @@ -350,8 +350,7 @@ async fn post_kdf(data: JsonUpcase, headers: Headers, mut conn: D user.client_kdf_iter = data.KdfIterations; user.client_kdf_type = data.Kdf; - user.set_password(&data.NewMasterPasswordHash, None); - user.akey = data.Key; + user.set_password(&data.NewMasterPasswordHash, &data.Key, None); let save_result = user.save(&mut conn).await; nt.send_user_update(UpdateType::LogOut, &user).await; @@ -560,8 +559,8 @@ async fn post_email( user.email_new = None; user.email_new_token = None; - user.set_password(&data.NewMasterPasswordHash, None); - user.akey = data.Key; + user.set_password(&data.NewMasterPasswordHash, &data.Key, None); + let save_result = user.save(&mut conn).await; nt.send_user_update(UpdateType::LogOut, &user).await; diff --git a/src/api/core/emergency_access.rs b/src/api/core/emergency_access.rs index f15c1b8e..d6c45d15 100644 --- a/src/api/core/emergency_access.rs +++ b/src/api/core/emergency_access.rs @@ -644,7 +644,7 @@ async fn password_emergency_access( let data: EmergencyAccessPasswordData = data.into_inner().data; let new_master_password_hash = &data.NewMasterPasswordHash; - let key = data.Key; + let key = &data.Key; let requesting_user = headers.user; let emergency_access = match EmergencyAccess::find_by_uuid(&emer_id, &mut conn).await { @@ -662,8 +662,7 @@ async fn password_emergency_access( }; // change grantor_user password - grantor_user.set_password(new_master_password_hash, None); - grantor_user.akey = key; + grantor_user.set_password(new_master_password_hash, key, None); grantor_user.save(&mut conn).await?; // Disable TwoFactor providers since they will otherwise block logins diff --git a/src/db/models/user.rs b/src/db/models/user.rs index 611c4ebb..5a1bb4b5 100644 --- a/src/db/models/user.rs +++ b/src/db/models/user.rs @@ -147,17 +147,18 @@ impl User { /// # Arguments /// /// * `password` - A str which contains a hashed version of the users master password. + /// * `new_key` - A String which contains the new aKey value of the users master password. /// * `allow_next_route` - A Option> with the function names of the next allowed (rocket) routes. /// These routes are able to use the previous stamp id for the next 2 minutes. /// After these 2 minutes this stamp will expire. /// - pub fn set_password(&mut self, password: &str, allow_next_route: Option>) { + pub fn set_password(&mut self, password: &str, new_key: &str, allow_next_route: Option>) { self.password_hash = crypto::hash_password(password.as_bytes(), &self.salt, self.password_iterations as u32); if let Some(route) = allow_next_route { self.set_stamp_exception(route); } - + self.akey = String::from(new_key); self.reset_security_stamp() }